Scans duration.

[NumberFive 0]

Good morning.

We have all clients in X organization set to start a full scan every day at 21:00 (almost the at the same time for all)

The client is complaining that the scans are starting in the morning instead.

After checking the detailed info on the scans for the previous days, the scan times are widely inconsistents.
The scans all show that they started at the correct time (or so the console claims)
The machines in the organization are almost all identical.
Some scans are finishing in half an hour, others are taking 12 hours.

Scan settings have the "invoke ASAP if failed" flag checked out.
The only target to scan is C:\.

Edited October 19, 2018 by NumberFive

[MartinK 378]

Could you please select one specific client with this problem and open "execution history"? It is possible that scan is actually started at correct time, but maybe it takes so long? Is it possible that scan is started in different time due to timezone differences ? Are you actually using local or UTC time when defining task trigger.

[NumberFive 0]

Hello MartinK, ty for your reply.

I can't check the execution history today, I'll check on Monday.
Regarding the time, we're using local time, and all the machines have the correct time.

[NumberFive 0]

On 10/19/2018 at 10:35 AM, MartinK said:

Could you please select one specific client with this problem and open "execution history"? It is possible that scan is actually started at correct time, but maybe it takes so long? Is it possible that scan is started in different time due to timezone differences ? Are you actually using local or UTC time when defining task trigger.

The scans are starting at the correct times.
Set to use local time.
Client complained yesterday of the same thing.
Today @ 9am, the scan ins't over yet. It's been running for 8 hours.
Yesterday it started at 1am and it ended at 6pm, but that was because the user was forced to keep pausing the scan, or else he couldn't work.

If they're indeed taking this long, it's a serious problem.

Edited October 24, 2018 by NumberFive

[NumberFive 0]

UPDATE

Went to the client to check out the logs.
Tried to export, but probably missed something because it only exported :

<?xml version="1.0" encoding="utf-8" ?>
<ESET>
  <LOG>
    <RECORD>
      <COLUMN NAME="Hora">23-10-2018 01:00:00</COLUMN>
      <COLUMN NAME="Pastas rastreadas">C:\</COLUMN>
      <COLUMN NAME="Rastreadas">3072021</COLUMN>
      <COLUMN NAME="Infectadas">0</COLUMN>
      <COLUMN NAME="Limpas">0</COLUMN>
      <COLUMN NAME="Status">Concluído</COLUMN>
    </RECORD>
 </LOG>
</ESET>

But anyway, since the scan was running I checked the scan log, and there were alot of yellow messages all with info like:

I'll go back to the client late this afternoon and I'll get a screenshot of the messages (or part of them).

---edited---

Attached 2 new screenshots

The messages says "Archive is password protected" and the bottom one as messages like "Not possible to open" "extract error"

Edited October 25, 2018 by NumberFive

[NumberFive 0]

I'm guessing theres nothing to be done?

[MichalJ 434]

@NumberFive I am not good in Spanish, but it looks to me, that the amount of files scanned is 3+ million.

Can you maybe share some details about the affected machine? Size of the disk? Type of the drive? What is the configuration of the scan? Does it scan local drives only, or "all targets" is set?

[NumberFive 0]

On 11/2/2018 at 11:07 AM, MichalJ said:

@NumberFive I am not good in Spanish, but it looks to me, that the amount of files scanned is 3+ million.

Can you maybe share some details about the affected machine? Size of the disk? Type of the drive? What is the configuration of the scan? Does it scan local drives only, or "all targets" is set?

It's Portuguese, but close enough:)..

The scan was set to full, I've changed it to smart scan to test (don't have feedback yet).
It's a standart 500gbs HDD.
Scanning for C:\ only.

[Marcos 5,074]

Try disabling scanning of archives. Since they may contains gigabytes of data that needs to be unpacked and scanned, it obviously takes a lot of time.