cancel
Showing results for 
Search instead for 
Did you mean: 
gawn
Level 7
Report Inappropriate Content
Message 1 of 7

Move Assets Between Data Source Profiles?

I need to move some assets in the Physical Display from one grouping to a new one. This is being done as part of a cleanup effort and to get both application and OS logs. To apply two Data Source Models to the same asset, (e.g. OS and IIS) I need to apply two Data Source profiles. This will involve moving the asset from "Receiver->asset" to "Receiver->Data Source group->asset".

I'm concerned that this will cause the loss of whatever logs have been gathered to date.

6 Replies
xded
Level 12
Report Inappropriate Content
Message 2 of 7

Re: Move Assets Between Data Source Profiles?

Hi gawn,

did i understand you right? You want to move Datasource from one Receiver to another? If yes and you want to move all than you can use the migrate option of each Receiver.

gawn
Level 7
Report Inappropriate Content
Message 3 of 7

Re: Move Assets Between Data Source Profiles?

The intent is not to move between two Receivers (although we do have two) but to better organize the schema for better, more comprehensive log collection.

If this is the best way to move them without losing logs then I could shuffle the assets between Receivers...

Highlighted
McAfee Employee andy777
McAfee Employee
Report Inappropriate Content
Message 4 of 7

Re: Move Assets Between Data Source Profiles?

Got it, but same rules still apply. No nice way to move data between Parent/Children unfortunately. Set devices to disabled, enable the Hide Disabled option under the user Options and future logs will be better organized while older logs will still be searchable.

McAfee Employee andy777
McAfee Employee
Report Inappropriate Content
Message 5 of 7

Re: Move Assets Between Data Source Profiles?

The key to never losing ESM data is to never delete a data source. You can uncheck the Parsing/Logging boxes and disable it, but if you delete it, then the data goes along with it. As xded mentioned, there is a "Migrate" button under Receiver Properties | Data Sources, but if that isn't an option, then the practice is always disable and recreate elsewhere. Never delete a data source until you're done with the data.

xded
Level 12
Report Inappropriate Content
Message 6 of 7

Re: Move Assets Between Data Source Profiles?

But disabled Datasourcen is a dead Datasource that count for the limit of 2000 Datasources for each receiver or mabey only for the 4600 ERC.

McAfee Employee andy777
McAfee Employee
Report Inappropriate Content
Message 7 of 7

Re: Move Assets Between Data Source Profiles?

True statement. If that's an issue though, you're likely already using client data sources then and the same rules apply and you get a 62k+ more data sources.

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community