Carbon Black Cloud: What do the Background Scan Statuses mean?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

What do the background scan statuses in Event Viewer mean?

Environment

• CB Defense Sensor 1.0.6.194 and Higher
• Microsoft Windows: All Supported Versions

Resolution

 

BACKGROUND_SCAN: DISABLED	This message is recorded each time when the Carbon Black Cloud sensor service starts (typically after Windows reboot).  This indicates that background is disabled for the device (either at the policy level or at the organization level.)
BACKGROUND_SCAN: IN_PROGRESS	This message is recorded when the background scan starts.  If the Carbon Black Cloud sensor service restarts (typically when Windows reboots) this message is recorded. The Carbon Black Cloud sensor service will resume from the previous scanned location.
BACKGROUND_SCAN: COMPLETE	This message is recorded once the background scan completes.  There will be no more occurrence after background scan completes – as each device will perform the background scan just once.

Additional Information

These events are purely informational and require no further action. You can read further on how the Background Scan works in the Background Scan FAQ article linked under related content.