cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
leblanc_daniel_
Engaged Sweeper III
Hello,

My security groupe found that this week end lansweeper scan, they say that it scan everyday of the week end.
Is there on activity log to show what happen or not happen, could it be something else on the same server.

Dan
1 ACCEPTED SOLUTION
Daniel_B
Lansweeper Alumni
You need to ensure that Scan logging is enabled. Scans will only get logged after you enabled it. You won't be able to list scan attempts which were made before enabling scan logging.

Alternatively run the following report which lists the last scan dates for all your assets:

Select Top 1000000 tblAssets.AssetID,
tblAssets.AssetName,
tblAssets.IPAddress,
tblAssets.Lastseen,
tblAssets.Lasttried,
tblAssets.Lasttriggered,
tblAssets.LastScheduled,
tblAssets.LastActiveScan,
tblAssets.LastIPScan,
tblAssets.LastLsPush
From tblAssets
Order By tblAssets.Lasttried Desc

View solution in original post

5 REPLIES 5
Daniel_B
Lansweeper Alumni
Port 88 is used for authentication, ports 135, 49157 and 49159 by WMI and ports 445 and 389 for Active Directory queries. Authentication happens during scanning of any PC (several packets per scan). Active Directory queries are performed while having Active scanning or Scheduled computer scanning enabled. The refresh of computer or user details happens once every 24 hours.
leblanc_daniel_
Engaged Sweeper III
Finally found that it was not SCANNING but LanSweeper was talking(communication was using these port: 88,135, 445,389, 49157, 49159) to ours DC server(4 server DC) for over 10 000 paquets, this is considered a bit WAY to much , any reason why some much paquets?

Could these be the reason in Configuration>Server option>Asset Cleanup Option>Refresh Active Directory computer user detail..and...Configuration>Server option>User Cleanup Option>Refresh Active Directory user....

No option has been enable to do any actions in scanning methods

Dan
Daniel_B
Lansweeper Alumni
You need to ensure that Scan logging is enabled. Scans will only get logged after you enabled it. You won't be able to list scan attempts which were made before enabling scan logging.

Alternatively run the following report which lists the last scan dates for all your assets:

Select Top 1000000 tblAssets.AssetID,
tblAssets.AssetName,
tblAssets.IPAddress,
tblAssets.Lastseen,
tblAssets.Lasttried,
tblAssets.Lasttriggered,
tblAssets.LastScheduled,
tblAssets.LastActiveScan,
tblAssets.LastIPScan,
tblAssets.LastLsPush
From tblAssets
Order By tblAssets.Lasttried Desc
kaioshin2
Engaged Sweeper II
Hi,

I tried to run this command, but unfortunately it show me only 5 scans.
This is really strange because I know i did some "Rescan asset" and some IP range scanning recently. I mean a lot more than only 5, i would say more than 30.

If there a way to show all type of scan that i did recently ?

Thanks a lot

Steph
Daniel_B
Lansweeper Alumni
If you would like to log scanning activities, you can do this by enabling scan logging under Configuration\Server options, section Scan logging. Afterwards run a report like the following example which lists all scans made in a certain time period.

Select Top 1000000 tblScanHistory.ScanServer,
tsysScanningMethods.ScanningMethod,
tblScanHistory.Description,
tblScanHistory.ScanTime,
tblAssets.AssetID,
tblAssets.AssetName,
tsysAssetTypes.AssetTypename,
tblAssets.IPAddress
From tblAssets
Left Join tsysAssetTypes On tsysAssetTypes.AssetType = tblAssets.Assettype
Right Join tblScanHistory On tblAssets.AssetID = tblScanHistory.AssetId
Inner Join tsysScanningMethods On tsysScanningMethods.ScanningMethodId =
tblScanHistory.ScanningMethodId
Where tblScanHistory.ScanTime Between '2015-06-15' And '2015-07-01'
Order By tblScanHistory.ScanTime Desc