2 Replies Latest reply on Aug 11, 2008 11:35 AM by runcmd

    On-Access Scan Log - Increase Detail

    runcmd
      McAfee VirusScan Enterprise v8.0i / Patch 10 / Engine 5200

      I have user complaining that McAfee is chewing up CPU cycles at 13:00 every day and dragging the computer down. On-demand scan is not running at this time and there are no timeouts in the on-access scan log for this timeframe. My theory is that something on the computer is accessing large files, large numbers of files, network resources over a slow connection, or any combination of the three. Is there a way to crank up the detail of the on-access scan logs? What I want to do is log everything the on-access scanner looks at without having to open the On-Access Scan Statics and look at "Last file scanned" in real time. If the logs can be verbose, I can try to figure out what is being accessed when the lag occurs.

      Thanks for taking the time to read my post. Any & all responses greatly appreciated.
        • 1. RE: On-Access Scan Log - Increase Detail
          Sounds like the autoupdate process is running in the background.. Try updating to Patch #14 or later which helps with such issues, and just in case it is a scanning process which is starting up, install the latest 5300 scan engine from the link below:

          http://www.mcafee.com/apps/downloads/security_updates/engines.asp?region=us&segm ent=enterprise

          By the way, to look at the full "On AccessScan Log" on VS 8.0i, check at the path below:

          C:\Documents and Settings\All Users\Application Data\Network Associates\VirusScan\OnAccessScanLog.txt

          Hope this helps.

          Grif
          • 2. RE: On-Access Scan Log - Increase Detail
            runcmd
            Thanks for the follow up. The McAfee Agent Activity Log doesn't show any activity in the 13:00 range for the past few days, so I don't believe the issue to be related to updates. I did look at the OnAccessScan log but, as previously stated, I don't see any scan timeouts around 13:00. I was hoping to find a way to have the On-Access Scanner report everything it has looked at. I'm currently working with our SMS system administrator to determine if software inventories are occurring at that time which would cause McAfee to look at mass numbers of files. If I determine SMS is not performing an inventory at ~13:00, I'll try updating to the most recent patch number and, potentially, the 5300 engine. Thanks again.