Distributed Scan

This section covers the following topics:

How a Distributed Scan Works
Distributed Scan Requirements
- Proxy Agent Requirements
- Supported Targets
Start a Distributed Scan
Monitor a Distributed Scan Schedule

You can use ER2 to perform a distributed scan on a Target or Target location using a group of Proxy Agents. Distributed scans allow you to:

Improve scanning time by having multiple scanning processes executed in parallel.
Optimize resources by distributing the scanning load across multiple Proxy Agent hosts which might otherwise have been unutilized.

Distributed scans are particularly useful for scanning Targets that have a vast number of locations, for example:

An Exchange Server with thousands of mailboxes.
A Microsoft SQL Server with hundreds of databases, with thousands of tables per database.

For more information, see Distributed Scan Requirements below.

How a Distributed Scan Works

When a distributed scan starts, the Master Server starts off by collecting information about the Target(s). The Master Server uses this information to break down the Target(s) into smaller components or sub-scans, then proceeds to distribute the scan workload among the Proxy Agents that are assigned to the scan.

Each Proxy Agent then starts to execute the assigned sub-scans on the Target(s). Results for the Target(s) are progressively processed and displayed in the Web Console as each sub-scan completes.

A distributed scan schedule is marked as "Complete" only when all sub-scans distributed among all Proxy Agents have been completed.

Distributed Scan Requirements

Proxy Agent Requirements

To perform a distributed scan on a Target or group of Targets, you need to Create an Agent Group to be assigned to the Target or Target location. Ensure that all Proxy Agents in the Agent Group:

Have been upgraded to version 2.0.31 and above.
Support scanning of the Target platform.

If any Proxy Agent within the Agent Group does not support scanning of the Target, all sub-scans assigned to the Proxy Agent will not be executed, subsequently causing the scan schedule to fail.

To run a distributed scan on a MySQL database, ensure that the Agent Group assigned to the scan only contains Windows Proxy Agents or Linux Proxy Agents.
If the Agent Group assigned to scan the MySQL database includes a Solaris Proxy Agent, the scan schedule will be marked as "Failed" due to incomplete sub-scans.

Supported Targets

You can run a distributed scan on the following supported Target types:

Target Type	Description
Windows Share	Scans are distributed across the folders and files under the Path of the network storage location as specified in the scan schedule. If the network storage Path in the scan schedule is specified as MyFolder, the scan will be distributed across all files and folders within the MyFolder directory. If the number of files under the Path exceeds a certain limit, distributed scanning will be disabled for the scan schedule, the change will be captured in the Activity Log, and the network storage Path will then be assigned to a single Proxy Agent from the Agent Group.
Remote Access via SSH	Scans are distributed across the folders and files under the Path of the network storage location as specified in the scan schedule. If the network storage Path in the scan schedule is specified as MyFolder, the scan will be distributed across all files and folders within the MyFolder directory. If the number of files under the Path exceeds a certain limit, distributed scanning will be disabled for the scan schedule, the change will be captured in the Activity Log, and the network storage Path will then be assigned to a single Proxy Agent from the Agent Group.
IBM DB2	Scans are distributed across the tables in the database.
MariaDB	Scans are distributed across the tables in the database.
Microsoft SQL Server	Scans are distributed across the tables in the database.
MySQL	Scans are distributed across the tables in the database.
Oracle Database	Scans are distributed across the tables in the database.
PostgreSQL	Scans are distributed across the tables in the database.
Sybase / SAP ASE	Scans are distributed across the tables in the database.
SharePoint Server	Scans are distributed across the sites in the SharePoint Server.
Amazon S3 Buckets	Scans are distributed across the Amazon S3 Buckets in the Amazon account.
Azure Storage	Scans are distributed across the Blobs, Tables or Queues in the Azure Storage account.
Exchange Domain	Scans are distributed across the mailboxes in the Exchange domain.
Office 365 Mail	Scans are distributed across the mailboxes in the Office 365 domain.
G Suite	Scans are distributed across the users in the G Suite domain.
Rackspace Cloud	Scans are distributed across the cloud server regions in the Rackspace account.
SharePoint Online	Scans are distributed across the sites in the SharePoint Online domain.

Start a Distributed Scan

Running a distributed scan is the same as starting any other scan.

Log into the Web Console.
Expand the navigation menu, ENTERPRISE RECON .
In DASHBOARD, TARGETS, or SCHEDULE MANAGER, click Start Search.
On the Select Locations page, click + Add Unlisted Target. Follow the on-screen instructions to add a new Target.
When prompted to select an Agent to act as proxy host, click on the Select proxy agent menu and select a suitable Agent Group.
If any Proxy Agent within the Agent Group does not support scanning of the Target, all sub-scans assigned to the Proxy Agent will not be executed, subsequently causing the scan schedule to fail.
Click Test, and then Commit.
On the Select Data Types page, select the Data Type Profiles to be included in your scan and click Next. See Data Type Profiles.
Set a scan schedule in the Set Schedule section. Click Next.
Review your scan configuration. Once done, click Start Scan.

Monitor a Distributed Scan Schedule

Distributed scans show up in the TARGETS page and SCANNING > Schedule Manager page in the Web Console just like any other scan. See View and Manage Scans for more information.