From SEPM->Monitor->Log, view scan log, finding some scan action status as Scanning, but in SEP client scan log show these actions have completed.
under Program File\Symantec\Symantec Endpoint Protection Manager\data\inbox\agentinfo, there are many err files, which caused by unusual system or conditions.
These err files will block agent info to be written to database, which cause insistent from SEPM with SEP client scan action.
1) Stop SEPM service,
2) remove err files under Program File\Symantec\Symantec Endpoint Protection Manager\data\inbox\agentinfo
3) Start SEPM service
4) SEPM will rebuild and collect agent info from clients, if those scan completed logs exist on client (located in such as **\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\12.1.1000.157.105\Data\Logs\AV), scan logs on SEPM will reflect the scan as Completed.
Noted: If there are unexpected scenaio(such as sudden poweroff) occured while scanning, and there is no scan closeure log on SEP client , or scan log have been removed due to overdue, SEPM can't receive scan closing status.
Imported Document ID: TECH199914
Subscribing will provide email updates when this Article is updated. Login is required.