To know which files Symantec Endpoint Protection (SEP) scans with File System Auto-Protect (AP).
SEP does not log each file that it scans to the client logs, as doing so would result in a loss of performance and usability of the computer. However, you can see the last file that the AP engine scanned, using the Auto-Protect Scan Statistics.
To view Auto-Protect Scan Statistics
In the Auto-Protect Scan Statistics window, in the Last file scanned section, you can see the last file that the AP driver scanned, and the path for that file.
Note: This information should not be used to determine if files exception are appropriately applied, as excluded files still touch the AP driver and appear here. See File System Auto-Protect Scan Statistics shows excluded files being scanned.The 'Last file scanned' entry will show the last file that was actively* scanned by the Symantec Endpoint Protection Auto-Protect engine.
Please note that with the 'File Cache' option enabled for Auto-Protect you may see that recently touched files may not be listed in the viewer. To know more about the Auto-Protect File cache feature see Customizing Auto-Protect for Windows clients.