cancel
Showing results for 
Search instead for 
Did you mean: 

Query for Extra.DAT Adoption Rate

Jump to solution

Does anyone know how to create a query to determine the adoption rate of machines in your environment with an extra.DAT?

I have had success with tracking the adoption rate of the normal DAT using a boolean query type and setting the configuration criteria by using:

Property                                                      Comparison                                        Value

DAT Version (VirusScan Enterprise)    Is within X versions of repository          = 3

I cannot find a way to report on the extra.DAT, however. Any help is greatly appreciated.


1 Solution

Accepted Solutions

Re: Query for Extra.DAT Adoption Rate

Jump to solution

All -

After some more digging around, I was able to find the solution to this.

Under Menu -> Software -> Extensions -> I had to remove the "VirusScan Enterprise Reports" package. I then went to my product download page and re-downloaded the VSE 8.8 patch 1 repost that contained an updated version of "VirusScan Enterprise Reports". This allowed me to report on the extra.DAT in ePO 4.6.1 finally.

With that updated reports extension, I was successfully able to run the query listed above by Nielsb.

10 Replies
mjmurra
Level 12
Report Inappropriate Content
Message 2 of 11

Re: Query for Extra.DAT Adoption Rate

Jump to solution

Can't access my EPO server now, but I have exactly that query (it's a dashboard).

Extra.dat name is available, and I basically have a summed table that rolls it up showing extra.dat name and number of clients with that extra.dat

If no-one else provides an answer, hopefully will have the details tomorrow.

Nielsb
Level 11
Report Inappropriate Content
Message 3 of 11

Re: Query for Extra.DAT Adoption Rate

Jump to solution

My extra dat query:

extra dat deployment.PNG

Save as xml file and import the query:

<queries>

<query>

  <name language="sv">VSE: Extra DAT Deployment</name>

  <description language="sv">Displays the highest Extra DAT versions, and a slice for all the other versions.</description>

  <property name="target">EPOLeafNode</property>

  <property name="tableURI">query:table?orion.table.columns=EPOComputerProperties.ComputerName%3AEPOComputerProperties.DomainName%3AEPOLeafNode.os%3AEPOComputerProperties.Description%3AEPOLeafNode.Tags%3AEPOProdPropsView_VIRUSCAN.productversion%3AEPOProdPropsView_VIRUSCAN.hotfix%3AEPOProdPropsView_VIRUSCAN.servicepack%3AEPOProdPropsView_VIRUSCAN.enginever%3AEPOProdPropsView_VIRUSCAN.enginever64%3AEPOProdPropsView_VIRUSCAN.datver%3AEPOLeafNode.LastUpdate&amp;orion.table.order.by=EPOComputerProperties.ComputerName%3AEPOComputerProperties.DomainName%3AEPOLeafNode.os%3AEPOComputerProperties.Description%3AEPOLeafNode.Tags%3AEPOProdPropsView_VIRUSCAN.productversion%3AEPOProdPropsView_VIRUSCAN.hotfix%3AEPOProdPropsView_VIRUSCAN.servicepack%3AEPOProdPropsView_VIRUSCAN.enginever%3AEPOProdPropsView_VIRUSCAN.enginever64%3AEPOProdPropsView_VIRUSCAN.datver%3AEPOLeafNode.LastUpdate&amp;orion.table.order=az</property>

  <property name="conditionURI">query:condition?orion.condition.sexp=%28+where+%28+version_ge+EPOProdPropsView_VIRUSCAN.productversion+%228%22+%29+%29</property>

  <property name="summaryURI">query:summary?pie.slice.title=EPOProdPropsView_VIRUSCAN.datver&amp;pie.count.title=EPOLeafNode&amp;orion.query.type=pie.pie&amp;orion.sum.query=true&amp;show.percentage=false&amp;orion.sum.group.by=EPOProdPropsView_VIRUSCAN.extradatnames&amp;orion.sum.order=desc&amp;orion.sum.limit.count=360&amp;orion.show.other=true&amp;orion.sum.aggregation=count&amp;orion.sum.aggregation.showTotal=true</property>

</query>

</queries>

Re: Query for Extra.DAT Adoption Rate

Jump to solution

Something I fogot to mention earler is that this is for ePO 4.6 patch 1.

I am not having success with that query in this environment, but it does appear to work in ePO 4.5 patch 3. I looks like the value for Extra.DAT was removed between those versions.

ePO 4.5 VSE Properties:

ePO_4.5.JPG

ePO 4.6 VSE Properties:

ePO_4.6.1.JPG

If I can see the information the in VSE console, I should be able to report on it. C'mon McAfee!

Message was edited by: waynediesel on 6/7/12 10:32:50 AM CDT

Re: Query for Extra.DAT Adoption Rate

Jump to solution

All -

After some more digging around, I was able to find the solution to this.

Under Menu -> Software -> Extensions -> I had to remove the "VirusScan Enterprise Reports" package. I then went to my product download page and re-downloaded the VSE 8.8 patch 1 repost that contained an updated version of "VirusScan Enterprise Reports". This allowed me to report on the extra.DAT in ePO 4.6.1 finally.

With that updated reports extension, I was successfully able to run the query listed above by Nielsb.

hemantk
Level 12
Report Inappropriate Content
Message 6 of 11

Re: Query for Extra.DAT Adoption Rate

Jump to solution

Hello Waynediesel.

I tried the same thing & it helped me too...........

Thanks.....

Nielsb
Level 11
Report Inappropriate Content
Message 7 of 11

Re: Query for Extra.DAT Adoption Rate

Jump to solution

sorry wordwrap was enabled in notepad

herby the correct export of my extradat query

<queries>

<query>

  <name language="sv">VSE: Extra DAT Deployment</name>

  <description language="sv">Displays the highest Extra DAT versions, and a slice for all the other versions.</description>

  <property name="target">EPOLeafNode</property>

  <property name="tableURI">query:table?orion.table.columns=EPOComputerProperties.ComputerName%3AEPOComputerProperties.DomainName%3AEPOLeafNode.os%3AEPOComputerProperties.Description%3AEPOLeafNode.Tags%3AEPOProdPropsView_VIRUSCAN.productversion%3AEPOProdPropsView_VIRUSCAN.hotfix%3AEPOProdPropsView_VIRUSCAN.servicepack%3AEPOProdPropsView_VIRUSCAN.enginever%3AEPOProdPropsView_VIRUSCAN.enginever64%3AEPOProdPropsView_VIRUSCAN.datver%3AEPOLeafNode.LastUpdate&amp;orion.table.order.by=EPOComputerProperties.ComputerName%3AEPOComputerProperties.DomainName%3AEPOLeafNode.os%3AEPOComputerProperties.Description%3AEPOLeafNode.Tags%3AEPOProdPropsView_VIRUSCAN.productversion%3AEPOProdPropsView_VIRUSCAN.hotfix%3AEPOProdPropsView_VIRUSCAN.servicepack%3AEPOProdPropsView_VIRUSCAN.enginever%3AEPOProdPropsView_VIRUSCAN.enginever64%3AEPOProdPropsView_VIRUSCAN.datver%3AEPOLeafNode.LastUpdate&amp;orion.table.order=az</property>

  <property name="conditionURI">query:condition?orion.condition.sexp=%28+where+%28+version_ge+EPOProdPropsView_VIRUSCAN.productversion+%228%22+%29+%29</property>

  <property name="summaryURI">query:summary?pie.slice.title=EPOProdPropsView_VIRUSCAN.datver&amp;pie.count.title=EPOLeafNode&amp;orion.query.type=pie.pie&amp;orion.sum.query=true&amp;show.percentage=false&amp;orion.sum.group.by=EPOProdPropsView_VIRUSCAN.extradatnames&amp;orion.sum.order=desc&amp;orion.sum.limit.count=360&amp;orion.show.other=true&amp;orion.sum.aggregation=count&amp;orion.sum.aggregation.showTotal=true</property>

</query>

</queries>

Printscreen added of my post

extra dat query.PNG

Message was edited by: Nielsb on 8/17/12 3:19:15 AM CDT
dnf
Level 10
Report Inappropriate Content
Message 8 of 11

Re: Query for Extra.DAT Adoption Rate

Jump to solution

Hi all,

¿does somebody know what´s the difference between the N/A and a "blank space" when reporting the superdat version?

Thanks

mjmurra
Level 12
Report Inappropriate Content
Message 9 of 11

Re: Query for Extra.DAT Adoption Rate

Jump to solution

Different point products.

VSE will generally show N/A, but in my environment LinuxShield shows Blank. Also clients that only have the agent and no VSE show blank too.

hemantk
Level 12
Report Inappropriate Content
Message 10 of 11

Re: Query for Extra.DAT Adoption Rate

Jump to solution

Hello Nielsb,

I tried copying & save ti as xml & then tried to import, but i got error as "An unexpected error ocured"