Specifications

• Because the scan timed out due to the size of the file, which is a 1059 event
• The file was not scanned because it was inaccessible due to a password or encryption on the file,
which is a 1051 event
Disable these two events under event filtering to prevent a flood of these events into your database.
By disabling these events you are effectively telling the agent to stop sending these events to ePolicy
Orchestrator.
These events are still logged locally by VirusScan Enterprise in the
On-access scanner log file for reference on the local client.
Optionally, you can disable additional events but this is not typically necessary since most of the other
events are important and are usually generated in manageable numbers. Plus, you can enable
additional events as long as you monitor your event summary query to make sure that the new event
you enabled does not overwhelm your database.
Filtering 1051 and 1059 events
Disable the 1051 and 1059 events if you find a significant number of these events when you run Event
Summary Query.
Task
1
Under Setting Categories, click Menu | Configuration | Server Settings, Event Filtering, then Edit. The Edit Event
Filtering dialog box appears.
2
From The Agents Forwards list, scroll down until you see the following events, and deselect them:
• 1051: Unable to scan password protected (Medium)
• 1059: Scan Timed Out (Medium)
3
Click Save.
12
FAQ and common scenarios
1051 and 1059 events
104
McAfee
®
ePolicy Orchestrator
®
4.0 and 4.5 Best Practices Guide