Real-time scanning monitors traffic coming in, going out, and/or executing on your servers. Trend Micro recommends that real-time scanning always be enabled.

Scheduled scanning gives you an opportunity to do a periodic check on your servers, perhaps on a weekly basis. The scheduled scan allows you to include directories or file types that you do not constantly monitor using real-time scanning. Since a scheduled scan might be more inclusive, it could utilize more of your computing resources; thus, you might want to arrange scheduled scans for non-peak hours, such as early Sunday morning.

Manual scanning allows you to perform a scan of your servers on demand. For example, when an outbreak occurs, there is a period of vulnerability between the time of discovery and the release of the Trend Micro pattern file designed to detect the new threat. Even though that period is typically a matter of hours, your servers may be vulnerable during that time. After Trend Micro downloads the updated pattern file, run a manual scan to see whether any malware arrived on your servers while you were vulnerable. Another time to perform a manual scan is when the servers are back online after maintenance downtime.