I have a requirement to test that VirusScan scans files when they are read and written. I'm having trouble finding a log file that will help me prove this requirement.
It would be great if someone could point me in the right location on either the ePO server or direct on the client.
I don't think that is possible from the logging perspective, but you can use a system monitor to do that. or you can use the eicar test file to trigger a detection.
Do you also know that a file is not scanned on each access (assuming it matches the scanning policy) unless (is hasbeen modified OR the dat file has been updated) AND it has not been scanned after its last write.