topic Re: Scan stuck on \\?\GLOBALROOT\Device\HardiskVolume3\System Volume Information\tracking.log in Cortex XDR Discussions

Scan stuck on \\?\GLOBALROOT\Device\HardiskVolume3\System Volume Information\tracking.log

fred.l — Mon, 02 May 2022 13:23:47 GMT

Hello, we are using Cortex in a Citrix PVS environment.

We installed the agent with the VDI flag on the master vDisk. When we try to generate a scan on the new version of the vDisk, it always stuck on this file:

\\?\GLOBALROOT\Device\HardiskVolume3\System Volume Information\tracking.log

We know that tracking.log a file responsible of the ntfs changes and other things and that we can't have access to this folder because it's protected by the sytem.

But is there any way to exclude this file from the scan via the cytool imageprep scan command line ? We tried to change the timeout values or the upload value but nothing changes and we could not find any documentation using the /help flag.

Other thing we tried: scan with the malware module DISABLED => nothing changed.

The restore file features is disabled on our drives.

Thanks you for your help,

Fred

Re: Scan stuck on \\?\GLOBALROOT\Device\HardiskVolume3\System Volume Information\tracking.log

bbucao — Wed, 04 May 2022 03:24:34 GMT

Hi Fred.L,

Can you share what agent version you are using?

Thanks,

Ben

Re: Scan stuck on \\?\GLOBALROOT\Device\HardiskVolume3\System Volume Information\tracking.log

fred.l — Wed, 04 May 2022 09:33:33 GMT

Hello Ben,
Thank you for your interest.
Here is the agent version we are running (OS 2019 Server):
Cortex XDR 7.5.1.40243
Fred

Re: Scan stuck on \\?\GLOBALROOT\Device\HardiskVolume3\System Volume Information\tracking.log

bbucao — Wed, 04 May 2022 13:24:09 GMT

Hi Fred.L,

Are you using the CE (Critical Environment) version? Or just the standard 7.5? The reason I ask is if you are not using the CE version then I would recommend using version 7.6 or later. Prior to 7.6 there were similar issues reported that were fixed in the agent 7.6 release. If you are using the CE version then I recommend opening a support case so our support engineers can conduct advanced troubleshooting.

Regards,

Ben

Re: Scan stuck on \\?\GLOBALROOT\Device\HardiskVolume3\System Volume Information\tracking.log

fred.l — Wed, 04 May 2022 13:26:33 GMT

Hi Ben,
I will ask for the security team and will answer you as soon as I can. Thank you for this precision.
Fred

Re: Scan stuck on \\?\GLOBALROOT\Device\HardiskVolume3\System Volume Information\tracking.log

fred.l — Wed, 18 May 2022 13:37:33 GMT

Hello Ben,
I update the discussion: after following your recommendations, we upgrade the agent to the 7.7 version and the scan completed successfully.
Thank you for your help,
Fred