Where are the scan events logged in the SEP for Linux agent.

Products

• Endpoint Protection

Issue/Introduction

You would like to know where to find scan events in SEP for Linux new agent (14.3 RU1 and newer). 

Environment

 SEP for Linux new agent (14.3 RU1 and newer). 

Resolution

Manual scan events are found on the SEPM for scans initiated from the SEPM, (active scan, full scan, custom scan). Since these commands are sent from the SEPM to the agent, the responses from those commands are sent back to SEPM.

The scan events are logged in the sisamd_*.log when AMD "trace" logging is enabled. 

For the manual scan initiated from sav tool locally on the client, the scan events are not added into the AVMan.log and these events are not sent to SEPM.

Sav tool manual scan events are found in the agent's sisamd_*.log