Event ID 257 and 258

KB ID 0000116 


Event 257

VirusScan Enterprise, message: Would be blocked by behaviour blocking rule (rule is currently in warn mode) (warn only mode!).(from <source> IP <IP> user <user> running VirusScan Enter 8.0 OAS)

Event 258

Would be blocked by port blocking rule (rule is in warn-only mode)


McAfee Anti Virus

event 257


This harmless alert, which can be ignored. To stop this logging to the event log, open the Viruscan Console, go to Tools -> Alerts -> Additional alerting options, and select “Suppress all except severe alerts (severity <4)”.

If you are using ePO, you will have to adjust the policies in the same manner.

For ePO Managed Machines.

1. Log into ePO, Select “System Tree” > Assigned Policies > Change the prodict to “Virus Scan Enterprise (version) > Alert Policies > My Default.

epo event 257

2. Change the drop down from workstationserver as approriate > Additional allerting Options > “suppress all exept severe alers (severtity <4) > Save.

epo stop event logging


Related Articles, References, Credits, or External Links


Author: Migrated

Share This Post On