Has anyone been able to figure out how to report or create a dashboard to view all parent or child data sources who no longer are communicating into the ESM ?
We have 1000's of MS Windows systems reporting into the ESM using the Windows event collection agent and at times even though the service continues to run the communication between the agent and the ERC fails.
I know that a yellow flag shows up on the data source but there are lots of false positives when using child data sources, also if you have 1000's of agents spread around in the ESM getting a consolidated view of these broken agents would be an asset in resolving the issues
Solved! Go to Solution.
There are a couple of builtin reports that might help here:
Otherwise, the device reports should help as well. It's not a dashboard or report but it should help you do what you need:
Hope this helps!
Thanks for your reply but the report unfortuantley doesn't wrk as it only reports on data sources that are collection logs, it doesn't show the data sources with a 0 EPS.
I will look at the other option and advise my findings
Bumping this, because this isn't completely solved. There's still no facility described here for putting the data onto a dashboard, and in my case (working as an MSP) the device reporting isn't a suitable alternative.