Identification of the event initiator

Each event in Kaspersky Scan Engine has an Initiator—someone or something that triggered the event.

You can find information about the initiator on the Kaspersky Scan Engine dashboard, in the Initiator column of the events table. If you want to display events triggered by a certain initiator, you can use the Initiator filter.

In the Initiator column, the following values are possible:

• The name of the user (the login). This value means that the user has initiated the event through the Kaspersky Scan Engine GUI. For example, logged in or restarted Kaspersky Scan Engine by clicking the Restart button.
• Service Scan Engine. This value means that Kaspersky Scan Engine initiated the event, either itself or by user command. For example, Kaspersky Scan Engine itself can run an update on a schedule or run an update after a user has clicked the Update button. Clicking the Update button here is an event initiated by a user, and running the update is a separate event initiated by Kaspersky Scan Engine.
• IP address. This value means that an HTTP or ICAP client sent a request to the Kaspersky Scan Engine API. For example, sent a file to scan.

  The IP address of a scan request initiator is also displayed in the Client column of the scan results table. You can find this table on the Scan results page of the Kaspersky Scan Engine GUI.

You can also find information about the initiator in syslog messages.