4 Replies Latest reply on Jul 28, 2008 3:03 AM by Makke

    Relation between anti-virus software and failing iniventory scans




      We have several issues with our implementation of LANDesk within our infrastructure. One of those issues are failing inventory scans.


      From the 900 managed devices, there are 150 which didn't/couldn't register a complete inventory scan. To troubleshoot this, we are looking at some processes which might interfere with the inventory proces.


      As I don't have a full understanding of how the inventory proces works, I wanted to know if there could be a relationship between settings of our anti-virus software on our core server and the inventory process? As far as I can see from the different logs, the anti-virus software isn't causing any trouble. However, because I don't understand the inventory process on the core server very well, it still might be causing problems.


      Can someone help me with this or point me in the right direction? Is there any detailed information of how the whole inventory process from client to core to database works and which processes are involved?


      Thanks in advance.



        • 1. Re: Relation between anti-virus software and failing iniventory scans
          phoffmann SupportEmployee

          Define "couldn't / wouldn't" do an inventory scan. Also - what version are you on?


          The client never sent a scan, or the Core rejected the scan file (usually because of some value being too large for a DB table)?


          If the client can't SEND inventory, then usually either AV is at fault (it's killing us somehow) - but there it would depend on which AV you use (and whether it has a "process-scanning" ... i.e. - some AV's don't scan just LDISCN32.EXE - but ALL the files that LDISCN32.EXE touches (which is pretty much the entire hard drive) - that can cause problems, so mark it as an exclusion to that.


          If it's a matter of the client SENDING inventory but the core rejecting it, check the APPLICATION NT EVENT LOG on the Core as a first port of call. The Inventory service logs to there why it'd reject a scan.


          Paul Hoffmann

          LANDesk EMEA Technical Lead.

          • 2. Re: Relation between anti-virus software and failing iniventory scans



            We are using LDMS 8.8. Anti-virus is Sophos Anti-Virus.


            We define an inventory scan incomplete when the inventory values "Login Name", "Full Name", "Model" and "Operating System" on the core server are empty after the managed device did 3 inventory scans or more. Furthermore the icon in front of the device name has a red circle with a red stripe in it.


            We are at a loss here why this behaviour occurs. We do not have any evidence that clients cannot send the inventory information to the core. The same goes for the core rejecting inventories. NT Logs don't mention those errors.


            Furthermore, the behaviour is very inconsistent. One day a device could not be reachable and inventory data is not complete, the other day, all is well.


            However, I will follow you leads as to anti-virus keeping the process LDISCN32.exe or its data busy. I'll report on that later.



            • 3. Re: Relation between anti-virus software and failing iniventory scans
              phoffmann SupportEmployee

              Ok so...


              ... ignore the fact that a client has a "red circle" - that's probably due to out-dated network information (since the network information wouldn't be updated).


              A few things for you to do.


              1 - Go to an affected device, and run an inventory scan with at least the "/V" command-line option (edit the shortcut for the inventory scan). If this "finishes" without error, it means the Client is capable to send an inventory scan, and it gets rejected on the Core for some reason.


              If you have an error here, the "/V" will give us a good idea where we run into a problem. ("/V" stands for Verbose).


              2 - Assuming the scan-file actually gets sent through to the Core, you'll want to look at the NT APPLICATION EVENT LOG on the Core - if an inventory scan is rejected, we'll log the reason for "why" there.


              See also my comments in here:



              Essentially, we're still at a stage where we need to figure out whether the client is the problem, or whether the scan-file makes it to the Core and just gets rejected there for some reason.


              Paul Hoffmann

              LANDesk EMEA Technical Lead

              1 of 1 people found this helpful
              • 4. Re: Relation between anti-virus software and failing iniventory scans

                Hi Paul,


                Thanks for your help so far.


                I made a new shortcut for them to use to start a inventory scan. This shortcut uses the /V and /SYNC switches and makes a logfile for every machine.


                I'll get back to you when I have some results.