Monitoring scanning requests

Symantec Protection Engine provides a feature that lets you define the expected scanning load for specific time periods. When the Symantec Protection Engine scanning load decreases significantly, it might indicate a performance issue. You can use this feature to detect possible problems before they become critical. If Symantec Protection Engine detects fewer scan requests than the expected load, it logs the event to the designated logging destinations and alert destinations. The event is logged at the Warning level.

See Logging levels and events

Symantec Protection Engine averages the number of scan requests for one minute. If the average number of requests for that minute meets or exceeds the threshold, no alert is sent. If the average number of scan requests for that minute is below the threshold, Symantec Protection Engine sends an alert.

For example, if you set a threshold of 20 requests per second for Wednesday from 1:00 A.M. to 2:00 A.M., Symantec Protection Engine does not generate an alert for any minute in which it receives 1,200 or more requests (20 requests times 60 seconds). Symantec Protection Engine only generates an alert for any minute in which it receives fewer than 1,200 requests.

All of the schedules that you create appear in the Existing Schedules table. Active schedules are denoted in green; inactive schedules are denoted in red.

You can control how scanning requests are monitored in the following ways:

  • Enable or disable the scan request monitor feature.

  • Add a new schedule.

  • Deactivate an existing schedule.

  • Activate a deactivated schedule.

  • Delete a schedule.

To enable or disable the scan request monitor feature

  1. In the console on the primary navigation bar, click Monitors.

  2. In the sidebar under Views, click Requests.

  3. In the content area under Monitor Requests, do one of the following steps:

    • To enable the feature, check Monitor requests.

      You must enable the feature to add, activate, deactivate, or delete any schedules.

    • To disable the feature, uncheck Monitor requests.

    This feature is disabled by default.

  4. On the toolbar, select one of the following options:

    Save

    Saves your changes.

    Use this option to continue making changes in the console until you are ready to apply them.

    Apply

    Applies your changes.

    Your changes are not implemented until you apply them.

To add a new schedule

  1. In the content area under Plan a Schedule, click the Day drop-down list, and select the day of the week that you want to monitor.

    You can only select one day.

  2. Click the From drop-down list, and select the beginning hour for the schedule time range.

    This setting uses a 24-hour clock. For example, 14 is 2:00 PM. You can select a range from 0 (12:00 AM of the day selected by the user) to 23 (11:00 PM). Hours that you have already used to create schedules for that day do not appear in the list.

  3. Click the To drop-down list, and select the ending hour for the schedule time range.

    This option uses a 24-hour clock. For example, 14 is 2:00 PM. You can select a range from 0 (12:00 AM of the previous day) to 23 (11:00 PM). For example, if you select Tuesday, select 23 from the From drop-down list, and then select 0 from the To drop-down list, you are monitoring the threshold for the last hour of the day on Tuesday.

    Hours that you have already used to create schedules for that day do not appear in the list.

  4. In the Threshold box, type the threshold that represents the expected file load at which you want Symantec Protection Engine to issue an alert.

    Specify a threshold that would signify a possible issue but not generate a high number of false alarms.

  5. In the sidebar under Tasks, click Add Schedule.

    The schedule appears in the Existing Schedules table. New schedules are activated by default.

  6. On the toolbar, select one of the following options:

    Save

    Saves your changes.

    Use this option to continue making changes in the console until you are ready to apply them.

    Apply

    Applies your changes.

    Your changes are not implemented until you apply them.

To deactivate an existing schedule

  1. In the content area under Existing Schedules in the Existing Schedules table, click the schedule that you want to deactivate.

  2. Under Plan a Schedule, uncheck Enable Schedule.

  3. In the sidebar under Tasks, click Update Schedule.

    The schedule appears in red in the Existing Schedules table.

  4. On the toolbar, select one of the following options:

    Save

    Saves your changes.

    Use this option to continue making changes in the console until you are ready to apply them.

    Apply

    Applies your changes.

    Your changes are not implemented until you apply them.

To activate a deactivated schedule

  1. In the content area under Existing Schedules in the Existing Schedules table, click the schedule that you want to activate.

  2. Under Plan a Schedule, check Enable Schedule.

  3. In the sidebar under Tasks, click Update Schedule.

    The schedule appears in green in the Existing Schedules table.

  4. On the toolbar, select one of the following options:

    Save

    Saves your changes.

    Use this option to continue making changes in the console until you are ready to apply them.

    Apply

    Applies your changes.

    Your changes are not implemented until you apply them.

To delete a schedule

  1. In the content area under Existing Schedules in the Existing Schedules table, click on schedule that you want to delete.

  2. In the sidebar under Tasks, click Delete Schedule.

  3. On the toolbar, select one of the following options:

    Save

    Saves your changes.

    Use this option to continue making changes in the console until you are ready to apply them.

    Apply

    Applies your changes.

    Your changes are not implemented until you apply them.

See How to monitor Symantec Protection Engine performance.

Imported Document ID: HOWTO79762
Legacy ID: v15225399_v80846623

Thanks for your feedback. Let us know if you have additional comments below. (requires login)

    © 1995-2019 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.