Long Malware Scan time, normal?

[SeanDeHarris]

hello all experts, 

I have encountered a long scanning time,  i launched a malware scan from console to isolated endpoint, the job was created at 15:30 and finished by 05:30 by next day.

Guessing when the job was created, either the agent was disconnected/fail to sync/the server failed (through websocket) to connect to agent/scan was finished early but failed to update the status to the server.

In order to prove my assumption, gone through the Management Audit logs or Agent audit log cannot find much info.

Is it possbile to look for 

1) when was agent (disconnected from the server)

2) failure logs when server cannot reach the agent

3) the scanning time of a malware scan

Thanks,