Where is the activity logs for LanSweeper

[leblanc_daniel_]

Hello,

My security groupe found that this week end lansweeper scan, they say that it scan everyday of the week end.
Is there on activity log to show what happen or not happen, could it be something else on the same server.

Dan

[Daniel_B]

Port 88 is used for authentication, ports 135, 49157 and 49159 by WMI and ports 445 and 389 for Active Directory queries. Authentication happens during scanning of any PC (several packets per scan). Active Directory queries are performed while having Active scanning or Scheduled computer scanning enabled. The refresh of computer or user details happens once every 24 hours.

[leblanc_daniel_]

Finally found that it was not SCANNING but LanSweeper was talking(communication was using these port: 88,135, 445,389, 49157, 49159) to ours DC server(4 server DC) for over 10 000 paquets, this is considered a bit WAY to much , any reason why some much paquets?

Could these be the reason in Configuration>Server option>Asset Cleanup Option>Refresh Active Directory computer user detail..and...Configuration>Server option>User Cleanup Option>Refresh Active Directory user....

No option has been enable to do any actions in scanning methods

Dan

[Daniel_B · Accepted solution]

You need to ensure that Scan logging is enabled. Scans will only get logged after you enabled it. You won't be able to list scan attempts which were made before enabling scan logging.

Alternatively run the following report which lists the last scan dates for all your assets:

Select Top 1000000 tblAssets.AssetID,
  tblAssets.AssetName,
  tblAssets.IPAddress,
  tblAssets.Lastseen,
  tblAssets.Lasttried,
  tblAssets.Lasttriggered,
  tblAssets.LastScheduled,
  tblAssets.LastActiveScan,
  tblAssets.LastIPScan,
  tblAssets.LastLsPush
From tblAssets
Order By tblAssets.Lasttried Desc

[kaioshin2]

Hi,

I tried to run this command, but unfortunately it show me only 5 scans.
This is really strange because I know i did some "Rescan asset" and some IP range scanning recently. I mean a lot more than only 5, i would say more than 30.

If there a way to show all type of scan that i did recently ?

Thanks a lot

Steph

[Daniel_B]

If you would like to log scanning activities, you can do this by enabling scan logging under Configuration\Server options, section Scan logging. Afterwards run a report like the following example which lists all scans made in a certain time period.

Select Top 1000000 tblScanHistory.ScanServer,
  tsysScanningMethods.ScanningMethod,
  tblScanHistory.Description,
  tblScanHistory.ScanTime,
  tblAssets.AssetID,
  tblAssets.AssetName,
  tsysAssetTypes.AssetTypename,
  tblAssets.IPAddress
From tblAssets
  Left Join tsysAssetTypes On tsysAssetTypes.AssetType = tblAssets.Assettype
  Right Join tblScanHistory On tblAssets.AssetID = tblScanHistory.AssetId
  Inner Join tsysScanningMethods On tsysScanningMethods.ScanningMethodId =
    tblScanHistory.ScanningMethodId
Where tblScanHistory.ScanTime Between '2015-06-15' And '2015-07-01'
Order By tblScanHistory.ScanTime Desc