Active machines now showing as No Agent

[acidfire52]

Hi guys,

I need some help.  We are running ePO 3.6.1, Agent 4.0, and VirusScan 8.5.  All was well last week, came in after the new year, and almost all of the machines are gone from the ePO.  Don't know how or why, just gone.  Talking about 1400 clients.  Go to Rogue System Detection, sees all the machines that were there now showing up as no agent.  All the workstations still have their agent and VS and seem to be updating from the ePO.

I set the Rogue System to resend the agent and add to the tree, a few machines have checked back in.  Under 100.

I don't know what info you guys need to diagnose this, but any help is appreciated.

Thanks

Ash Hampshrie

[GWIRT]

FYI, as of Dec. 31 ePO 3.6.1 is no longer supported.

That being said, something had to have happened to cause this. You can check the LeafNode table to see if there are any records there, if not, you will have to rebuild your Directory.

Was there anything done to the DB?

[acidfire52]

I have started to rebuild the database.  The odd thing, is I have pretty much all the machines back in the tree, but all under the lost and found\Rouge Systems.  I have sent multiple agent wake ups and even installs to them but they do not check in.

How would I check the LeafNodes?  Am not well versed in the ePO, self taught.

Thanks

Ash

[GWIRT]

You would need to query the LeafNode table in SQL, you could do that by running the following script:

select * from leafnode

If that doesn't return anything, then you are simply going to have to rebuild the system tree. If the agents aren't checking in, you might want to look at the agent logs on the clients to see what the problem is.

[acidfire52]

Looking at the agent status monitor, it says it is communicating with the server almost non-stop.  every 10-30 seconds it is connecting, sending, and closing.

I have attached a screenshot.

I force removed and reinstalled the agent on one machine, no improvement.

I am attaching the Agent log, looks ok I think except for:

2010-01-06 14:49:24 E #7560 SpiPkgr Error trace:
2010-01-06 14:49:24 E #7560 SpiPkgr  [Parse SPIPE package of size 27870]->
2010-01-06 14:49:24 E #7560 SpiPkgr   VerifySign error -2147483640

Help?

Message was edited by: acidfire52 on 1/6/10 2:58:19 PM GMT-07:00

[GWIRT · Accepted solution]

I would check the Agent_<machinename>.log on the machine. This doesn't look like healthy communication.

You might also try forcing the agent on the machine, that would cause it to reinstall and may resolve the issue.

[acidfire52]

Greg,

Just added that info to my last post.

Thanks a lot for your help so far.

Ash

[acidfire52]

Well, my test machine has just checked in.

removing and reinstalling the agent worked.

Now it appears I have to reinstall the agent on 1000+ machines...  not good.

Anything else I could try on a another machine?

[GWIRT]

This may mean that the ePO server had a new set of keys generated. With the directory being empty and the keys possibly being different, that sounds like ePO was reinstalled. If that's the case and you don't have a backup of the agent keys, you don't have an option but to reinstall all the agents.

You can also try doing an "update now" on one problem machine and see if the key updater corrects the issue. If not, you may be out of luck.

[acidfire52]

Well that is not good.  Have tried the update now, no go.

can you point me to more info one these keys?  Cannot find much in the admin guide.

Thanks again.

Ash