cancel
Showing results for 
Search instead for 
Did you mean: 
Grafis
Level 7

HIPS reporting - install base doubled after latest DAT

After HIPS DAT 6.1.0.1183 was deployed via ePO our install base in ePO reporting boubled with 50% reporting a version of ---

In ePO under properties for a machine node they indeed show two instances of HIPS, one with full properties and a second with only one or two properties. I have seen this behavior during installation (via ePO).
The count of false reports of HIPS has dropped ~10% in week or so since it doubled.

What would cause this?
Tags (3)
0 Kudos
10 Replies
Raja
Level 9

RE: HIPS reporting - install base doubled after latest DAT

What version of CMA is deployed?
0 Kudos
Grafis
Level 7

agent

It's all in my sig.
CMA 3.6.0.546 (confirmed as installed on several of the clients in question)
Still have about 2% of all machines on CMA 3.6.0.453
---
ePO 3.6.1.2.220
VSE 8.5p1
HIPS 6.1p1
NMA 3.0.0
VSM 8.0
Virex 7.7

0 Kudos
gerryrigney
Level 9

RE: HIPS reporting - install base doubled after latest DAT

What happens if you send an agent wakeup call (ticking the "Get Full Product Properties" box to one of the affected clients, then refresh its properties. That seems to fix the problem for me, I've also seen this issue when rolling out HIPS.

gr
0 Kudos
Grafis
Level 7

RE: HIPS reporting - install base doubled after latest DAT



Nice, that did the trick for 2 connected user I just tried.
And I have seen the initial doubling has slowly subsided, perhaps after field users (All my HIPS users are laptops with VPN) connect long enough for the Agent to Server communication to kick in (Full Properties @120min or @10min after 1 day for me).

What why how does the initial doubling happen? I too saw it on some machines (25%?) during deployment, but my entire base doubled after the last DAT update. Yow!
0 Kudos
chuck92103
Level 7

RE: HIPS reporting - install base doubled after latest DAT



We noticed this with the 7.x security content update. The version of HIPS does not show up in the ePO report sand it appears you have twice as many HIPS hosts as there are. A bug with McAfee and they need to address it.
0 Kudos
Grafis
Level 7

Again...

Just a note that it happened again with Yesterdays 1711 security update for HIPS.

I now have hundreds of phantom HIPS installs with Product version "--" in my reports and my clients show two instances of HIPS 6.1 in properties.
0 Kudos
chuck92103
Level 7

RE: Again...



The only way I know to address it is to do wake up calls from ePO. Regular ASC checkins do not work.

This has been escalated to engineering.
0 Kudos
gerryrigney
Level 9

RE: Again...

It's been a problem since the day I started using HIPS.

appreciate it if you keep us posted.
0 Kudos
starbucks88
Level 7

RE: HIPS reporting - install base doubled after latest DAT



Are you talking about the Installation count report? As that's how I found out there was a problem we had approx 1400 with HIPs one day and over 2000 the next! So I would say that the addition HIPS is included in the report. Unless you are talking about another report if so which one?
0 Kudos