Scan status on SEPM monitor show as scanning, while action has completed in SEP client

book

Article ID: 157371

calendar_today

Updated On:

Products

Endpoint Protection

Issue/Introduction

From SEPM->Monitor->Log, view scan log, finding some scan action status as Scanning, but in SEP client scan log show these actions have completed.

Cause

under Program File\Symantec\Symantec Endpoint Protection Manager\data\inbox\agentinfo, there are many err files, which caused by unusual system or conditions.

These err files will block agent info to be written to database, which cause insistent from SEPM with SEP client scan action.

Resolution

1) Stop SEPM service,

2) remove err files under Program File\Symantec\Symantec Endpoint Protection Manager\data\inbox\agentinfo

3) Start SEPM service

4) SEPM will rebuild and collect agent info from clients, if those scan completed logs exist on client (located in such as **\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Data\Logs\AV), scan logs on SEPM will reflect the scan as Completed.

Noted: If there are unexpected scenaio(such as sudden poweroff) occured while scanning, and there is no scan closeure log on SEP client , or scan log have been removed due to overdue, SEPM can't receive scan closing status.


Applies To

SEP 12.1