What is a recommended scan frequency?

[jimbarr]

I did a search on "scan frequency" and found some good information on how LS scans, when LS scans, and how to adjust LS scan frequency. But I do not see any "best practice" suggestions for setting scan frequency beyond the defaults of generally once per day.

I'd love to have more up-to-date data, meaning within the past hour or so, but I also want to keep a realistic balance between too many scans (that may over tax the network and devices) and too fes scans (relying on once-per-day data.) I absolutly get that LS is not a real-time alerting platform, but I'm thinking that reasonably increasing the scan frequency would provide closer to real-time visibility.

So that said, given that we have about 700 assets, is setting the scan frequency to every hour or so reasonable?

Suggestions?

Thanks!

[rom]

700 assets, if windows, I think hourly is fine, you just watch your scanning queue and increase the number of simultaneous computer scans... the good news is, it will only queue up stuff, its not like it will break the network or anything - it will still chug along at 20 computers at a time or whatever you set it to.  So, you go "hm i'm always queued up" so you first increase the simultaneous a bit, and if you're still queued up, add a second scan server...  well, and like Obi said, watch your CPU on the scan server as well.

[Obi_1_Cinobi · Accepted solution]

Hello there!

A "Best practice" suggestion is quite difficult, as this is highly environment-specific. But to increase scan frequency, make sure to have "smaller" scanning targets and distribute them over your scanning threads.

Depending on how frequently you wish to scan your assets, the scan time will need to be taken into account. For example, if you wish to scan your assets each hour, then you must ensure that your scanning targets can complete scanning within that hour. We would also recommend spreading the load on your scanning server by ensuring that not all scanning targets start at the same time. A staggered approach is preferred to make the most of the available scanning threads.

Do keep in mind that you can expand your available scanning threads, by spreading your scanning targets across multiple scanning servers. You can set up a combined maximum of 99 scanning threads per scanning server under Configuration\Server Options, divided between Computer threads and IP threads (one extra thread is allocated to your scan service):

• IP Threads determine how many IP's can be treated during scanning.
• Computer Threads determine how many Windows computers can be scanned simultaneously.

We can't really provide detailed instructions on how much you will need to spread the scanning of your subnets as this will depend on the type of assets you are scanning, your scan intervals for your Windows scan items, the CPU available for your scanning server, network speed... to name a few.

Some recommendations though:

• Increase the number of computer threads and IP threads your Lansweeper server can use under Configuration\Server Options, scroll down to Service Options. You could experiment with this setting, it's a CPU-dependent setting. We would recommend monitoring your Lansweeper server's CPU usage to find the sweet spot here.
• Lower the frequency at which you're scanning certain scanning targets by modifying your schedules under Scanning\Scanning Targets and make sure they kick off at different times.
• Lower the frequency at which certain items are scanned for Windows computers, under Scanning\Scanned Item Interval. More on this functionality can be read here: https://www.lansweeper.com/knowledgebase/managing-how-often-specific-data-is-scanned/