Monitoring scanning requests
Symantec Protection Engine provides a feature that lets you define the expected scanning load for specific time periods. When the Symantec Protection Engine scanning load decreases significantly, it might indicate a performance issue. You can use this feature to detect possible problems before they become critical. If Symantec Protection Engine detects fewer scan requests than the expected load, it logs the event to the designated logging destinations and alert destinations. The event is logged at the Warning level.
See Logging levels and events
Symantec Protection Engine averages the number of scan requests for one minute. If the average number of requests for that minute meets or exceeds the threshold, no alert is sent. If the average number of scan requests for that minute is below the threshold, Symantec Protection Engine sends an alert.
For example, if you set a threshold of 20 requests per second for Wednesday from 1:00 A.M. to 2:00 A.M., Symantec Protection Engine does not generate an alert for any minute in which it receives 1,200 or more requests (20 requests times 60 seconds). Symantec Protection Engine only generates an alert for any minute in which it receives fewer than 1,200 requests.
All of the schedules that you create appear in the Existing Schedules table. Active schedules are denoted in green; inactive schedules are denoted in red.
You can control how scanning requests are monitored in the following ways:
Enable or disable the scan request monitor feature.
Add a new schedule.
Deactivate an existing schedule.
Activate a deactivated schedule.
Delete a schedule.
To enable or disable the scan request monitor feature
In the console on the primary navigation bar, click .
In the sidebar under Views, click .
In the content area under Monitor Requests, do one of the following steps:
To enable the feature, check .
You must enable the feature to add, activate, deactivate, or delete any schedules.
To disable the feature, uncheck .
This feature is disabled by default.
On the toolbar, select one of the following options:
To add a new schedule
In the content area under Plan a Schedule, click the drop-down list, and select the day of the week that you want to monitor.
You can only select one day.
Click the drop-down list, and select the beginning hour for the schedule time range.
This setting uses a 24-hour clock. For example, 14 is 2:00 PM. You can select a range from 0 (12:00 AM of the day selected by the user) to 23 (11:00 PM). Hours that you have already used to create schedules for that day do not appear in the list.
Click the drop-down list, and select the ending hour for the schedule time range.
This option uses a 24-hour clock. For example, 14 is 2:00 PM. You can select a range from 0 (12:00 AM of the previous day) to 23 (11:00 PM). For example, if you select Tuesday, select 23 from the From drop-down list, and then select 0 from the To drop-down list, you are monitoring the threshold for the last hour of the day on Tuesday.
Hours that you have already used to create schedules for that day do not appear in the list.
In the box, type the threshold that represents the expected file load at which you want Symantec Protection Engine to issue an alert.
Specify a threshold that would signify a possible issue but not generate a high number of false alarms.
In the sidebar under Tasks, click .
The schedule appears in the Existing Schedules table. New schedules are activated by default.
On the toolbar, select one of the following options:
To deactivate an existing schedule
In the content area under Existing Schedules in the Existing Schedules table, click the schedule that you want to deactivate.
Under Plan a Schedule, uncheck .
In the sidebar under Tasks, click .
The schedule appears in red in the Existing Schedules table.
On the toolbar, select one of the following options:
To activate a deactivated schedule
In the content area under Existing Schedules in the Existing Schedules table, click the schedule that you want to activate.
Under Plan a Schedule, check .
In the sidebar under Tasks, click .
The schedule appears in green in the Existing Schedules table.
On the toolbar, select one of the following options:
To delete a schedule
In the content area under Existing Schedules in the Existing Schedules table, click on schedule that you want to delete.
In the sidebar under Tasks, click .
On the toolbar, select one of the following options:
See How to monitor Symantec Protection Engine performance.
Thanks for your feedback. Let us know if you have additional comments below. (requires login)