Device Control fails to send logs to the OfficeScan server

- Updated:
- 27 Jan 2017
- Product/Version:
- OfficeScan 11.0
- Platform:
- Windows 10 32-bit
- Windows 10 64-bit
- Windows 2003 Enterprise
- Windows 2003 Enterprise 64-bit
- Windows 2003 Standard
- Windows 2003 Standard 64-bit
- Windows 2008 Enterprise
- Windows 2008 Server Core
- Windows 2008 Standard
- Windows 2012 Enterprise
- Windows 2012 Web Server Edition
- Windows 7 32-bit
- Windows 7 64-bit
- Windows 8 32-bit
- Windows 8 64-bit
- Windows Vista 32-bit
- Windows Vista 64-bit
- Windows XP Home
- Windows XP Professional
- Windows XP Professional 64-bit

Summary

The Device Control feature is actively blocking or allowing the use of devices (e.g. USB drive). However, the action is not being logged on the OfficeScan server.

Details

The issue may be caused by the logs not being sent from the OfficeScan Agent to the OfficeScan Server often enough. The default is 3600 seconds (1 hour). To resolve the issue, configure the OfficeScan Agent to send the logs more often:

Log in to the OfficeScan Server host.
Modify the file [OfficeScan Installation path]\PCCSRV\ofcscan.ini.
Locate "SendLogPeriod" and change its value to "1800" seconds (30 minutes) or lower. For example: "SendLogPeriod=1800"
Save ofcscan.ini and close it.
Open the OfficeScan web console.
Go to Agents > Global Agent Settings.
Without modifying any values on the page, scroll down and click Save.

Agents will now update. It may take some time for all the agents to receive the new configuration. To hasten the update on an agent, you may right-click on the agent's system tray icon and choose Update Now.

If the issue persists, contact the Trend Micro Technical Support.