Missing Endpoints in Full Scan Report after upgrading to ENS

[JHCP]

Hi, We recently upgraded to ENS. We generate a weekly full scan report. We usually got around 700+ endpoints. However, after we upgraded to ENS (previously using VSE), the number of endpoints dropped to about 500. We checked the configurations and all seems the same as before? Are there any points that we missed? Thank you.

[LKS]

When you say endpoints dropped from 700+ to 500, first i would check how many client machines are being managed by EPO. Out of which how many machines are actively communicating to EPO. The scan report might be coming based on active machines.

[JHCP]

We actually checked it and the number of active machines are way above 500.

[LKS]

Okay the result is somewhere close to what i assumed. Could you please if all the machines got upgraded  to ENS properly. IS ENS installed successfully on all the client machine. What happened to other machine, why is not communicating. 

[chealey]

Hi @JHCP 

To add to what my colleague has already been suggesting. The ODS tasks you've created, are they custom or policy based ODS tasks? You will only get ePO Events for for policy based tasks.

Furthermore do you have the same McAfee Agent and ENS Options policy assigned to all machines? Check that these settings are in place: ENS Options Policy > Event Logging for ODS is set to All, and within the McAfee Agent policy the Event forwarding is set to Informational.

[JHCP]

Hi all,

Sorry for the lack of response. I have been quite busy this past few weeks.

@chealey  Thank you for your response. They are policy based ODS tasks and I have already set the logging for ODS to All but the numbers had not improved.

[mmuthuga · Accepted solution]

Adding that you should also check on a few machines not reporting full scan if the full scan task is started and completed. We have seen issues reported for scheduled on-demand scan (ODS) tasks not running. 

https://kc.mcafee.com/corporate/index?page=content&id=KB92071

Was my reply helpful?
If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

[JHCP]

Thanks for providing the knowledge center link, @mmuthuga,

I have tried re-creating the existing ODS task, based on the migrated ODS tasks and found some major improvements with the numbers. We are now monitoring it if it will stay consistent for a few weeks but I think this had fixed the issue.

[Tech-Nic]

Hello.
I do see the same behaviour here. It seems that the tasks disappear when you update from October update to December update or 10.7
Im investigating with support.
In the Agent log you can see that task is „sending“ to ENS , but you cannot find it in ENS Logs.

[AdithyanT]

Hi @Tech-Nic

Thank you for your responses and post. I just noticed this specific statement, Can you please help me with the Service Request number via DM?

The December update should not carry this reported issue of missing scheduled tasks, however, an upgrade to 10.7 from any previous version does exhibit this behavior. This is a bug that is being worked upon.

Current workaround is what you have implemented, creating/duplicating the existing tasks and assigning them back to the groups/endpoints in ePO should work around the issue.