How do I locate the exact <scanId> from active log files?

To find the exact <scanId> (a GUID format such as e7b71fea-6c59-47ea-a78f-d57b344437a5 or integer scan ID) needed to query the active search_queue_<scanId> table in local PostgreSQL, you can extract it using any of the following methods from the active Agent log files or diagnostic bundles:

Method 1: From SystemSearchLogFiles (Fastest & Most Direct)

The SystemSearchLogFiles are generated directly by the scanning engine (identityfinderCMD.exe) when a discovery or search process starts.

1. Navigate to the log directory:
2. • Path: C:\ProgramData\Identity Finder\Logs\SystemSearchLogFiles\
   • In Gather Data ZIP: [GatherData_Bundle.zip]\SystemSearchLogFiles\
2. Look at the log filenames or open the latest log file:
3. • Many log filenames include the Scan GUID or Task ID directly such as the following filename: SystemSearchLogFiles_e7b71fea-6c59-47ea-a78f-d57b344437a5.log
3. Inside the log file, search for the following initialization lines near the top of the file contents:

   [INFO] Starting Scan Session. ScanId: e7b71fea-6c59-47ea-a78f-d57b344437a5
   [INFO] Initializing Queue Table: search_queue_e7b71fea_6c59_47ea_a78f_d57b344437a5
   [DEBUG] PostgreSQLWrapper::ConnectToQueue: Target table "search_queue_e7b71fea-6c59-47ea-a78f-d57b344437a5"

Method 2: From EPSLogFiles (Endpoint Service Logs)

The Endpoint Service supervisor (idfEndpoint.exe) logs every scan instruction dispatched to the machine from the SDP Console.

1. Navigate to the following path:
2. • Path: C:\ProgramData\Identity Finder\Logs\EPSLogFiles\
   • In Gather Data ZIP: [GatherData_Bundle.zip]\EPSLogFiles\
2. Open the latest EPSLogFiles_*.log and search for the following terms:
3. • DispatchScan
   • Received Task
   • CreateQueue
3. Look for entries such as the following:

   [INFO] EndpointService: Received scan execution dispatch from Console. ScanId: [e7b71fea-6c59-47ea-a78f-d57b344437a5]
   [INFO] EndpointService::QueueManager: Creating local queue table for scan [e7b71fea-6c59-47ea-a78f-d57b344437a5]

Method 3: From MC Task Data or Policy XML Files

When a scan is dispatched, the agent writes the active task definition XML to the local disk:

1. Navigate to:
2. • Path: C:\ProgramData\Identity Finder\MC Task Data\
   • Root of Gather Data ZIP: Look for XML files with GUID names (e.g., e7b71fea-6c59-47ea-a78f-d57b344437a5.xml).
2. The GUID in the filename itself is the </scanId> / Task ID.
3. Inside the XML are the header attributes matching the scan. See the following example:

   <TaskDefinition id="e7b71fea-6c59-47ea-a78f-d57b344437a5" name="Quarterly FileShare Discovery" ...>

Method 4: From IFSLogFiles (Shipper Service Logs)

The Shipper Service (IDFMessagingSvc.exe) logs the scan ID when picking up results from the local database to transmit to Ingress:

1. Navigate to the following path:
2. • Path: C:\ProgramData\Identity Finder\Logs\IFSLogFiles\
2. Search for the following string: [INFO] ShipperService: Packaging scan results for ScanID [e7b71fea-6c59-47ea-a78f-d57b344437a5]

Quick PowerShell Commands to Find the Active <scanId>

Run these commands from PowerShell on the Agent host:

# Search SystemSearch logs for the active Scan ID or table name
Get-ChildItem "C:\ProgramData\Identity Finder\Logs\SystemSearchLogFiles\*.log" | 
    Select-String -Pattern "ScanId:", "search_queue_" | 
    Select-Object -First 5

# List all Task XML files currently staged for execution
Get-ChildItem "C:\ProgramData\Identity Finder\MC Task Data\*.xml" | 
    Select-Object Name, LastWriteTime

🗄️ Alternative: List Active Queue Tables Directly in PostgreSQL

If PostgreSQL is running, you don't even need the log files—you can query PostgreSQL's system catalog to list all active queue tables on the Agent using the following commands:

SELECT table_name 
FROM information_schema.tables 
WHERE table_schema = 'public' 
  AND table_name LIKE 'search_queue_%';

(The suffix of the returned table name is your exact active </scanId>).