Has anyone managed to workaround the inherent limitations of the MVM product when scanning a large number of hosts and reporting to PDF? PDF files seem to be capped at a small size (and yes there are some workarounds, but they don't fix the core issue of the PDF producer not being able to handle large amounts of data).
How do people scanning < 5000 hosts at a time handle this limitation?
I don't use the PDF report as my requirements are for very customized metrics.
I start with the CSV and go from there.
If you have the budget, develop a custom app using XML import or direct db connection...
Try de-selecting the Trend from the Summary Reports. This should fix the problem and also make your reporting faster. I would also suggest modifying where the report is generated. A bigger drive is better. I've noticed that the default directory is located on the OS's drive which in essence fills up pretty fast for huge reports.
Hope this will help you.Message was edited by: Stingner on 17/02/12 9:57:28 EST AM
Thanks for the responses (I have taken some time to respond, but did see them earlier).
I'm investigating using the XML, this does seem like an interested way of handling things.
Deselecting Trend doesn't really help much, as the data is still too large.
BTW, when I said < 5000 in the original post, I was actually meaning > 5000 (one of our scans actually peaks at around 10000 hosts) and most of the reporting is unuseable.
We scan around 50,000+ hosts every week. We did our own custom reports using Excel with an ODBC connection to the database. Costom reports are the way to go because not everyone is the same. We mostly try to focus on the audiance that will read it. We have some for techs and different ones for upper managment. You can ask a McAfee representative to help you get an NDA (Non Disclosure Agreement) for the database schema. This way you will know the in's and out's of the database structure will trying to build a report.
As Stinger and John both mentioned, it's uncommon for anybody to try to use the PDF reports for anything that large. PDF is cumbersome and difficult to disseminate any valuable information from even when small. Consider your audience, and narrow down the report(s) accordingly. You might try Asset Reports with various criteria, or mining the CSV or XML reports for the relevant data.
I hope that helps.
cgrim wrote:Consider your audience, and narrow down the report(s) accordingly. You might try Asset Reports with various criteria, or mining the CSV or XML reports for the relevant data.
I hope that helps.
The problem is that you actually have to be able to produce the CSVs or XMLs in the first place, and MVM doesn't cope with large numbers of hosts/high numbers of vulnerabilities well.
When producing CSV for example, the Reporting service can crash, transferring data isn't great in a multi-tiered MVM install etc. And yes, I can isolate using Asset reports, but still need to be able to get overall data.
While it's great to start ripping out data directly from the database, and doing a lot of manual work on that - it isn't really what I want to be doing. I want to be able to use the GUI to get the top 100 high vulns (for example). I want it to be useable. It isn't. And that's a PITA.
I am really curious if anyone has > 10K hosts in their environment and are running regular scans over the environment. And if so, does anyone get CSV/XML/HTML reporting working at all?