Checking scan logs from Symantec Endpoint Protection for Linux agent

Products

• Endpoint Security

Issue/Introduction

My Symantec Endpoint Protection for Linux agent is unmanaged and I want to check the results of a scheduled/on-demand scan

Resolution

AMD logs - provide information related to scanning:

/var/log/sdcsslog/amd.log
/var/log/sdcsslog/amdlog/sisamd_X.log

 

Example of an on-demand scan in sisamd_X.log

2024-06-24 12:01:24: <info> [AMDTraversalThread::run]:550 AntiMalware scan started
2024-06-24 12:01:24: <info> [AMDTraversalThread::run]:697 Total number of files to be scanned: 16
2024-06-24 12:01:25: <info> [AMDTraversalThread::run]:816 Total Bytes scanned : 25920361 in 1.01379 s.
2024-06-24 12:01:25: <info> [AMDTraversalThread::run]:834 AntiMalware scan finished

 

Example of a scheduled scan in amd.log:

MSTD,83,2024-06-24 00:30:00.000 Z-0000,I,0,R,,,,,root,,Antimalware,,,,2,,,,,Scan started on all directories files and extensions,,,,,Daily Scheduled Scan,,,,,,,,,,,,1719189000000,0,1719189000
MSTD,84,2024-06-24 00:33:29.000 Z-0000,I,0,R,,,,,root,,Antimalware,,,,2,,,,,Scan Complete: Viruses:0 Scanned:109468 Omitted:0,,,,,Daily Scheduled Scan,,,,,,,,,,,,1719189000000,1719189209000,1719189000