Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

Carbon Black Cloud: What do the Background Scan Statuses mean?

Carbon Black Cloud: What do the Background Scan Statuses mean?


  • CB Defense Sensor and Higher
  • Microsoft Windows: All Supported Versions


What do the background scan statuses in Event Viewer mean?


BACKGROUND_SCAN: DISABLEDThis message is recorded each time when the Carbon Black Cloud sensor service starts (typically after Windows reboot).  This indicates that background is disabled for the device (either at the policy level or at the organization level.)
BACKGROUND_SCAN: IN_PROGRESSThis message is recorded when the background scan starts.  If the Carbon Black Cloud sensor service restarts (typically when Windows reboots) this message is recorded. The Carbon Black Cloud sensor service will resume from the previous scanned location.
BACKGROUND_SCAN: COMPLETEThis message is recorded once the background scan completes.  There will be no more occurrence after background scan completes – as each device will perform the background scan just once.

Additional Notes

These events are purely informational and require no further action. You can read further on how the Background Scan works in the Background Scan FAQ article linked under related content.

Related Content

Was this article helpful? Yes No
No ratings
Article Information
Creation Date: