Environment
- CB Defense Sensor 1.0.6.194 and Higher
- Microsoft Windows: All Supported Versions
Question
What do the background scan statuses in Event Viewer mean?
Answer
| BACKGROUND_SCAN: DISABLED | This message is recorded each time when the Carbon Black Cloud sensor service starts (typically after Windows reboot). This indicates that background is disabled for the device (either at the policy level or at the organization level.)
|
| BACKGROUND_SCAN: IN_PROGRESS | This message is recorded when the background scan starts. If the Carbon Black Cloud sensor service restarts (typically when Windows reboots) this message is recorded. The Carbon Black Cloud sensor service will resume from the previous scanned location.
|
| BACKGROUND_SCAN: COMPLETE | This message is recorded once the background scan completes. There will be no more occurrence after background scan completes – as each device will perform the background scan just once.
|
Additional Notes
These events are purely informational and require no further action. You can read further on how the Background Scan works in the Background Scan FAQ article linked under related content.
Related Content
