There are three built-in tasks for ENSLTP:
- Quick Scan task
- Full Scan task
- Default Client Update task
The Quick Scan and Full Scan tasks are on-demand scan tasks, and the Default Client Update task updates the DAT/Engine files.
To check the status of the tasks:
Run the following command and check the Task Status column:
# /opt/isec/ens/threatprevention/bin/isecav --listtask
--------------------------------------------------------------------------------------------
|Index Task Name Task Type Task Status Last Run |
--------------------------------------------------------------------------------------------
|1 quick scan ODS Not Started Not Applicable |
|2 full scan ODS Not Started Not Applicable |
|3 Default Client Update task DAT and Engine Update Not Started Not Applicable |
--------------------------------------------------------------------------------------------
To view the configuration details for a task:
Run the following command:
# /opt/isec/ens/threatprevention/bin/isecav --showtask --index <index from the output of the listtask command above>
Quick Scan Example:
The following output shows the configuration for the Quick Scan task, which includes the following settings:
- Scan type of PUPs/Unknown Programs/Unknown Macros
- Scan location of Temporary folders (and the subfolders)
NOTE: Temporary folders are defined as /tmp, /usr/local/tmp, and /var/tmp.
- Scan all file extension types
- Use the Scan cache
- Primary scan action for files and PUPs is clean and the secondary action is delete
- Task is not scheduled
- Number of scan threads is 5
- Scan timeout is 45 seconds
# /opt/isec/ens/threatprevention/bin/isecav --showtask --index 1
Parameter Value
On Demand Task Name : quick scan
Scan compressed archive files : disable
Scan compressed MIME-encoded files : disable
Scan PUPS : enable
Scan Unknown Programs : enable
Scan Unknown Macros : enable
Scan Sub Folders : enable
Scan Local Drives : disable
Scan Tmp Folders : enable
Scan Network drives : disable
List of Scan Paths : Not defined
What to Scan : all
Scan Macros : disable
Scan Files with no extension : disable
Excluded File : Not defined
Excluded Path (Subfolder disabled) : Not defined
Excluded Path (Subfolder enabled) : Not defined
List of Excluded File Types : Not defined
Use Scan cache : enable
Primary scan action : clean
Secondary scan action : delete
Primary scan action for pups : clean
Secondary scan action for pups : delete
Schedule : Not defined
Number of threads : 5
Maximum scan time : 45
Full Scan Example:
The following output shows the configuration for the Full Scan task, which includes the following settings:
- Scan compressed archive files
- Scan type of PUPs/Unknown Programs/Unknown Macros
- Scan location of local drives (and the subfolders)
- Scan all file extension types
- Use the Scan cache
- Primary scan action for files and PUPs is clean and the secondary action is delete
- Task is not scheduled yet
- Number of scan threads is 5
- Scan timeout is 45 seconds
# /opt/isec/ens/threatprevention/bin/isecav --showtask --index 2
Parameter Value
On Demand Task Name : full scan
Scan compressed archive files : enable
Scan compressed MIME-encoded files : disable
Scan PUPS : enable
Scan Unknown Programs : enable
Scan Unknown Macros : enable
Scan Sub Folders : enable
Scan Local Drives : enable
Scan Tmp Folders : disable
Scan Network drives : disable
List of Scan Paths : Not defined
What to Scan : all
Scan Macros : disable
Scan Files with no extension : disable
Excluded File : Not defined
Excluded Path (Subfolder disabled) : Not defined
Excluded Path (Subfolder enabled) : /**/var/McAfee/agent/AgentEvents/Upload/
List of Excluded File Types : Not defined
Use Scan cache : enable
Primary scan action : clean
Secondary scan action : delete
Primary scan action for pups : clean
Secondary scan action for pups : delete
Schedule : Not defined
Number of threads : 5
Maximum scan time : 45
Default Client Update Example:
The following output shows the configuration for the Default Client Update task, which includes the following settings:
- Update the DAT and Engine files
- Scheduled to run at 15:15 UTC daily
# /opt/isec/ens/threatprevention/bin/isecav --showtask --index 3
Parameter Value
DAT and Engine Update Task Name : Default Client Update task
Schedule : Defined
Type : Daily
Start Time : 15:15 UTC
To schedule a task:
Run the following command:
# /opt/isec/ens/threatprevention/bin/isecav --scheduletask --daily --starttime <XX:XX>
--index <index from the output of the listtask command above>
NOTES:
- Specify the value of --starttime in XX:XX format. Specifying 2:00, for example, results in a syntax error.
- The displayed scheduled time is automatically UTC-based. You can specify --starttime in your time zone.
- Cron triggers the schedule. The scheduled task is included in /etc/crontab, for example:
# cat /etc/crontab
…
### ENSL SCHEDULED TASK INFORMATION FOLLOWS. DO NOT EDIT THIS SECTION. ###
15 00 * * * root /opt/isec/ens/threatprevention/bin/isecav --runtask --uuid "33313ed8-8688-4de7-b12b-8b1be7e46fcf"
00 02 * * * root /opt/isec/ens/threatprevention/bin/isecav --runtask --uuid "c98408b0-0b09-48a0-97fc-4f1f9902bc36"
Quick Scan Schedule Task Example:
The following example shows how to schedule the Quick Scan task to run at 2:00 daily:
# /opt/isec/ens/threatprevention/bin/isecav --scheduletask --daily --starttime 02:00 --index 1
Task was successfully scheduled
# /opt/isec/ens/threatprevention/bin/isecav --showtask --index 1
Parameter Value
On Demand Task Name : quick scan
…
Schedule : Defined
Type : Daily
Start Time : 17:00 UTC
