---
title: "What Log Errors Reveal the Cause of Scheduled Scans Failing?"
url: "https://dm0bkdes5q7a2ls.productfruits.help/en/article/what-log-errors-reveal-the-cause-of-failed-scheduled-scans"
language: "en"
last_updated: "2026-06-01T14:16:51.626Z"
---

# What Log Errors Reveal the Cause of Scheduled Scans Failing?

When a scheduled scan fails to run, the root cause is often captured in the Agent-side logs.

To assist your troubleshooting examine the EPS (Endpoint Service), IDF (SystemSearch), and IFS (Shipper) logs.

The following log errors are high-signal indicators that a scheduled scan is being blocked:

### 1\. EPS (Endpoint Service) Logs: Connectivity & Health

The EPS service is responsible for receiving the scan command from the console. Errors here prevent the Agent from even knowing a scan is scheduled.

-   **"Registration/Heartbeat Failed":** Indicates the Agent cannot communicate with the Spirion SaaS console. If the Agent isn't heartbeating, it won't receive the "Start Scan" instruction.
-   **"Connection Refused / Timeout":** Often caused by network boundaries (firewalls, proxies, or VPNs) blocking outbound traffic to the Spirion Ingress service.
-   **"Service Start/Stop Errors":** If the EPS service itself is crashing or failing to initialize, it cannot coordinate scan execution.

### 2\. IDF / SystemSearch Logs: Discovery & Execution

Once a scan is received, the IDF engine attempts to enumerate the Target and perform the search.

-   **"Access Denied / Unauthorized":** The Agent or the configured service account does not have the necessary permissions to access the **Target** (for example, a file share, mailbox, or database).
-   **"Target Enumeration Failed":** The Agent can reach the target but cannot "see" the files or folders within it, often due to credential expiration or network path changes.
-   **"Can't reach the queue host":** In distributed scans, this error occurs when a Search Agent cannot connect to the Discovery Agent's PostgreSQL/pgBouncer service (typically on port **5433**).
-   **"Retry Loops":** If the Agent repeatedly tries and fails to connect to a target, it may eventually time out the job.

### 3\. IFS (Shipper) Logs: Result Delivery

While these errors don't usually "block" a scan from starting, they prevent the results from appearing in the console, making it *look* like the scan didn't run.

-   **"Outbound Send Attempt Failed":** Results are being generated but cannot be shipped to the SaaS ingestion layer.
-   **"400/500-class HTTP Errors":** Indicates the Spirion Ingress service is rejecting the results payload, possibly due to a version mismatch or corrupted data.
-   **"Shipper Queue Full":** If the local PostgreSQL shipper queue is full and cannot be cleared, the Agent may stop processing new search results to prevent data loss.

### 4\. Infrastructure & Environment Errors

-   **"Postgres service not running":** For Windows Agents (v13.6+), the local PostgreSQL service must be active to manage the job and shipper queues. If this service is down, the scan cannot initialize.
-   **"Disk Full":** If the Agent's host machine has no disk space, it cannot write logs or temporary queue files, causing the scan to fail.

### Summary Checklist for Log Triage:

| Log Family | Key Error to Search For | What it Means |
| --- | --- | --- |
| **EPS** | `Heartbeat failed` | Agent is offline/disconnected from Console. |
| **IDF** | `Access Denied` | Permissions/Credential issue with the Target. |
| **IDF** | `Connection timed out` | Network/Firewall blocking access to the Target. |
| **IDF** | `Can't reach queue host` | Port 5433 is blocked between Agents. |
| **IFS** | `Send failed` | Results are stuck on the Agent; check network egress. |