Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Stolorg
New Contributor

Forticlient scanned file count way over actual number of files

FortiClient version: 5.2.3.0633

Corporate managed environment (I am not an administrator)

 

This is my scenario:

I have an external drive connected via USB.  I have about 250k files on this drive.  If I set the whole thing to be scanned, it gets to some point and then just keeps ticking up the scanned files counter about once a second and never finishes (if I leave it overnight it'll be on 500k files 'scanned' by the morning while I know there are only about 250k).  I am scanning a linux repository predominately containing .deb and .rpm files.

 

If I cut down the number files targeted in the scan, it seems fine.  I've narrowed the threshold to about ~50k files in a batch.  Batches over that number seem to hit some point and just tick up the file count without finishing. This is really annoying because in some cases I'm scanning folder-by-folder to stay under the threashold.

 

Has anyone else seen this?  Is there a fix for this?  This is a task I have to execute on a semi-regular basis.

 

-LJ

2 REPLIES 2
rwpatterson
Valued Contributor III

Welcome to the forums.

 

Just a shot in the dark, but could the high file count be due to the fact the FCT is scanning inside archives?

Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

Bob - self proclaimed posting junkie!See my Fortigate related scripts at: http://fortigate.camerabob.com
Stolorg

Thanks for the idea!  However in the scenario of:

 

Folder A = 30k files

Folder B = 15K files

Folder C = 20K files

(files count as provided by 'windows properties' and all files are .deb or .rpm)

 

Scanning the parent folder (65k files) creates the run-on scenario.

Scanning each folder individually reports a scanned file count = the windows file count.

 

So I don't think it's entering an archive to find more files?

 

I just came back from lunch and had a scan to a similar thing.  The 'item' field in FC was stuck on one .deb however the scanned files count was flying up well above 100K (when there was only about 40K in that folder grouping).

 

-LJ

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors