Event ID:556,85,564,37 and Source:SAVOnAccess

Hi All,

Anyone help me out this issue.

I observed that above event id's generated on only one day.

Please let me know what action reuqired for this event id's.



  • "Busy" servers and SAV policies set up for intensive scanning can cause them.  Keep an eye out for them again.

    Track when they occur and what the system was doing at that time.  To test if the SAV policy is too intensive apply a default SAV policy to the computer as see if the problem still occurs.

    Generally speaking, these errors are only a problem if the system is also exhibiting dramatic slow downs, hangs or delays, though they can occur on systems that are not exhibiting any of these symptoms.

  • Hi,

    Thank you.

    After we got alerts for these even id's server got rebooted for three times as we observed.

    Also we are getting below event id's and please let me know what action we need to do on these event id's also.

    Event id's: 9,16,34