eDAR scans are executed on all Endpoint Agents despite only specific target machines are scanned

Products

• Data Loss Prevention Endpoint Discover

Issue/Introduction

eDAR scans are executed on all Endpoint machines even though only specific target machines are selected.  For example, if you setup an Endpoint Discover scan per TECH218969 and execute the scan it will continue to run after the machines that are supposed to scan have finished scanning.

Resolution

The filter that determines which machines executes the filter is analyzed on the individual Endpoint Agents.

What you see is the expected behavior.

For example, if the filter is setup to run on two machines, the request is sent to all Endpoint Agents. Until every Endpoint Agent receives and reports back on the Endpoint scan, the scan will still be appear running. The two machines will report back and be a part of the count, but the percentage will be for the total agent pool, not just the ones in the filter.