What Log Errors Reveal the Cause of Scheduled Scans Failing?

To assist your troubleshooting examine the EPS (Endpoint Service), IDF (SystemSearch), and IFS (Shipper) logs.

The following log errors are high-signal indicators that a scheduled scan is being blocked:

1. EPS (Endpoint Service) Logs: Connectivity & Health

The EPS service is responsible for receiving the scan command from the console. Errors here prevent the Agent from even knowing a scan is scheduled.

• "Registration/Heartbeat Failed": Indicates the Agent cannot communicate with the Spirion SaaS console. If the Agent isn't heartbeating, it won't receive the "Start Scan" instruction.
• "Connection Refused / Timeout": Often caused by network boundaries (firewalls, proxies, or VPNs) blocking outbound traffic to the Spirion Ingress service.
• "Service Start/Stop Errors": If the EPS service itself is crashing or failing to initialize, it cannot coordinate scan execution.

2. IDF / SystemSearch Logs: Discovery & Execution

Once a scan is received, the IDF engine attempts to enumerate the Target and perform the search.

• "Access Denied / Unauthorized": The Agent or the configured service account does not have the necessary permissions to access the Target (for example, a file share, mailbox, or database).
• "Target Enumeration Failed": The Agent can reach the target but cannot "see" the files or folders within it, often due to credential expiration or network path changes.
• "Can't reach the queue host": In distributed scans, this error occurs when a Search Agent cannot connect to the Discovery Agent's PostgreSQL/pgBouncer service (typically on port 5433).
• "Retry Loops": If the Agent repeatedly tries and fails to connect to a target, it may eventually time out the job.

3. IFS (Shipper) Logs: Result Delivery

While these errors don't usually "block" a scan from starting, they prevent the results from appearing in the console, making it look like the scan didn't run.

• "Outbound Send Attempt Failed": Results are being generated but cannot be shipped to the SaaS ingestion layer.
• "400/500-class HTTP Errors": Indicates the Spirion Ingress service is rejecting the results payload, possibly due to a version mismatch or corrupted data.
• "Shipper Queue Full": If the local PostgreSQL shipper queue is full and cannot be cleared, the Agent may stop processing new search results to prevent data loss.

4. Infrastructure & Environment Errors

• "Postgres service not running": For Windows Agents (v13.6+), the local PostgreSQL service must be active to manage the job and shipper queues. If this service is down, the scan cannot initialize.
• "Disk Full": If the Agent's host machine has no disk space, it cannot write logs or temporary queue files, causing the scan to fail.

Summary Checklist for Log Triage: