Stop resource consumption scanning

Article
12/26/2022

This article describes how to stop resource consumption scan for Windows and Linux devices in Movere.

For stopping an inventory scan, You need to click stop in the Movere Console. However, stopping scan at the Console does not terminate an in-progress actual resource consumption scan. Since, The actual resource consumption bot runs as an installed service on target devices, the bots in an actual resource consumption scan run for the complete duration of the actual resource consumption scan configured in the console. For Windows, Even if you turn off the machines for several hours, the bot restarts when you reboot.

Stop Windows scanning

You can stop a Windows actual resource consumption scan using one of these methods. There are two ways to terminate a resource consumption scan.

Using ARC recall scan
Manually delete bots from the target device
Using a Powershell Script

Using ARC recall scan

You can run ARC recall scan to terminate ARC bots on the target devices as follows:

In the Movere console > Getting Started, select Arc Recall.
In What method of ARC recall would you like?, select the appropriate option.
1. Auto Generated: Select this option to terminate ARC bots on all Windows Target devices that are domain joined.
2. Browse for Windows Rescan file: Select this option to terminate ARC bots on specific Windows devices that may or may not be domain joined. Users need to attach a .csv rescan file with details of Windows machines that need to be targeted. Learn More on how to create a rescan file.
In Domains, select the domain or workgroup that you want to scan.
In Manage credentials, type in Windows account that has local admin access on the target machines.
In Credential Mapping, map the added credential to the respective domain or workgroup.
Start the ARC recall scan.

Manually delete bots from target device

You can manually delete the bots config file on each target device that will stop the scan from running as follows:

Navigate to C:\Windows\temp\Arc2
Delete the Movere.Arc2.exe.config file.
Navigate to C:\Windows\temp\Arc4
Delete the Movere.Arc4.exe.config file.

Using a Powershell Script

Run the following Powershell script from the console to stop the actual resource consumption scan on all the target devices.

$filelist = @("Admin$\temp\Arc2\Movere.Arc2.exe.config", "Admin$\temp\Arc2\Movere.Arc2.exe", "Admin$\temp\Arc4\Movere.Arc4.exe.config", "Admin$\temp\Arc4\Movere.Arc4.exe")
$folderlist = @( "Admin$\temp\Arc2", "Admin$\temp\Arc4")

$computerlist = Get-Content serverlist.txt

ForEach ($computer in $computerlist)
{
	Write-Host "${computer} - Stopping ARC2 Service"
	try
	{
		(Get-WmiObject -Class Win32_Service -ComputerName $computer | ?{ $_.Name -match "MovereArc2" }).StopService()
		Write-Host "${computer} - Arc2 service stopped"
	}
	catch
	{
		Write-Host "${computer} - Arc2 service not present"
	}
	
	Write-Host "${computer} - Stopping ARC4 Service"
	try
	{
		(Get-WmiObject -Class Win32_Service -ComputerName $computer | ?{ $_.Name -match "MovereArc4" }).StopService()
		Write-Host "${computer} - Arc4 service stopped"
	} 
	catch
	{
		Write-Host "${computer} - Arc4 service not present"
	}

	Write-Host "${computer} - Terminating ARC2 Process"
	try 
	{
	(Get-WmiObject -Class Win32_Process -ComputerName $computer | ?{ $_.ProcessName -match "Movere.Arc2.exe" }).Terminate()
		Write-Host "${computer} - ARC2 Process terminated"
	} 
	catch
	{
		Write-Host "${computer} - ARC2 Process not present"
	}
	
	Write-Host "${computer} - Terminating ARC4 Process"
	try
	{
		(Get-WmiObject -Class Win32_Process -ComputerName $computer | ?{ $_.ProcessName -match "Movere.Arc4.exe" }).Terminate()
		Write-Host "${computer} - ARC4 Process terminated"
	}
	catch
	{
		Write-Host "${computer} - ARC4 Process not present"
	}

	# Delete the Service
	Write-Host "${computer} - Deleting ARC2 Service"
	try
	{
		(Get-WmiObject -Class Win32_Service -ComputerName $computer | ?{ $_.Name -match "MovereArc2" }).delete()
		Write-Host "${computer} - Deleted Arc2 Service"
	}
	catch
	{
		Write-Host "${computer} - Arc2 Service not present"
	}
	
	Write-Host "${computer} - Deleting ARC4 Service"
	try
	{
		(Get-WmiObject -Class Win32_Service -ComputerName $computer | ?{ $_.Name -match "MovereArc4" }).delete()
		Write-Host "${computer} - Deleted Arc4 Service"
	}
	catch
	{
		Write-Host "${computer} - Arc4 Service not present"
	}

	Write-Host "${computer} - Cleaning up files"
	foreach ($file in $filelist)
	{
		$arcfilepath = Join-Path "\\$computer\" "$file"
		if (test-path $arcfilepath)
		{
			Write-Host "${computer} - $arcfilepath File exists" 
			try 
			{
				Remove-Item $arcfilepath -force -recurse -ErrorAction Stop
				Write-Host  "${computer} - $arcfilepath File deleted"				
			} 
			catch
			{
				Sleep 10
				Remove-Item $arcfilepath -force -recurse -ErrorAction Stop
				Write-host "${computer} - Error while deleting $arcfilepath. Reboot machine and try again."
				continue
			}

		}
		else
		{
			Write-Host "${computer} - $arcfilepath File does not exist"
		}
	}

	Write-Host "${computer} - Cleaning up folders"
	foreach ($folder in $folderlist)
    { 
        $arcfolderpath = Join-Path "\\${computer}\" "$folder"
        if (test-path $arcfolderpath) {
			try
			{
				Remove-Item $arcfolderpath -force -recurse -ErrorAction Stop
				Write-Host  "${computer} - ${arcfolderpath} Folder deleted"
			}
			catch
			{
				Sleep 10
				Remove-Item $arcfolderpath -force -recurse -ErrorAction Stop
				Write-host "${computer} - ${arcfolderpath} - Error while deleting."
			}
		}
		else
		{
			Write-Host "${computer} - ${arcfolderpath} Not found, skipping"
		}
    }
}

Stop Linux scanning

You can stop a Linux actual resource consumption scan using one of these methods.

Manually delete bots from the target device
Start a new Linux inventory scan

Manually delete bots from the target device

You can manually delete the bots config file on each target device that will stop the scan from running as follows:

Open BASH
Run pidof Movere.Arc.Linux.**
Run kill [PID] , where PID is the process ID returned from previous command.
Run rm -r ./Movere/*
This deletes all the files in the Movere folder.

Start a new Linux inventory scan

You can start a new Linux inventory scan on the device running the resource consumption scan. When Movere performs a Linux inventory scan, it first terminates any Movere processes it finds. If resource consumption scanning is turned off, Movere stops the existing resource consumption scan, and runs an inventory scan. Movere uses the pidof command to do this, and then the kill command to terminate the resource consumption scan process. As the inventory scan starts, this message is issued: “stopping existing Movere.Arc.Linux.Bot.x64 process”.

Next steps

Learn how to scan Windows devices.

Share via