What if Scheduled Scans Overlap?

The following topics describe what happens if multiple scheduled scans overlap:

Resource Contention on the Agent

If multiple scans are assigned to the same agent and their schedules overlap:

• Thread Management: The Agent will attempt to run the scans concurrently by spawning separate threads (Discovery and Search threads) for each job.
• Performance Impact: Each concurrent scan consumes CPU and RAM. If too many scans overlap, the Agent machine may become resource-constrained, causing all active scans to run slower.
• Queueing: If the Agent reaches its internal limit for concurrent tasks, subsequent work items may sit in the Job Queue until a thread becomes available.

Impact on the Target System

This is often the more critical concern than the agent itself:

• IOPS and Throughput: If 2 different scans are targeting the same file share or database simultaneously, they will compete for disk I/O and network bandwidth on that target.
• Throttling (Cloud Targets): For Targets like Microsoft 365 (OneDrive/Exchange), overlapping scans significantly increase the risk of hitting vendor API throttling. If the Target starts "backing off," both scans slow down or enter retry loops.

Result Shipping and Ingestion

• Shipper Queue: As findings are produced, they are placed in the Shipper Queue on the agent. If multiple scans are producing high volumes of results at once, the Shipper Process will send them to the Console in the order they were queued.
• Console Visibility: You may see results from both scans appearing in the Console at the same time. This does not cause data corruption, but it can make real-time monitoring of a specific job more "noisy."

Search History Integrity

• No Conflict: Overlapping scans do not "break" Search History.
• • Each scan definition maintains its own history.
  • Even if Scan A and Scan B are looking at the same file at the same time, they will each record their own completion status and hash independently.

Best Practices to Manage Overlap

If you find that your scans are frequently overlapping and causing performance issues do the following:

• Increase Staggering: Adjust the start times in your Scan Definitions to provide more "breathing room."
• Use Search History: Ensure Search History is enabled. This makes recurring scans finish much faster, naturally reducing the likelihood of an overlap with the next scheduled job.
• Add Search Agents (Fan-Out): For non-local scans, you can assign multiple Search Agents to the same scan. This increases the "worker" pool, allowing the system to process the overlapping work items more quickly.
• Monitor Job History: Regularly check the Scan Runs view. If you see a scan that usually takes 2 hours suddenly taking 6 hours, check if another large scan was running at the same time.

Summary

Overlapping scans won't "crash" the platform, but they can lead to "misleading slowness" where the product appears slow simply because it is competing with itself for resources. Staggering remains the best defense against this.