cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
serc09
Level 10
Report Inappropriate Content
Message 1 of 15

Check if task was successful

Hey there.

Is there any posibility to check if a client task was successful?

Example:

I create a client task like "Full System Scan" (scan on demand) for a group of ~50 clients.


How can i check that all the clients performed this task? Or where do I have set things up to get an email if the task wasn't performed?

Greetz from Germany

serc09

PS: using ePO 4.5

Labels (1)
14 Replies
JThomas
Level 9
Report Inappropriate Content
Message 2 of 15

Re: Check if task was successful

For On Demand Scan, you can try this:

Configuration --Server Settings --Event filtering

Enable event id: 1202 and 1203 in event filtering.

Wait for agent to communicate or send a wake up.

Any ODS task that gets started or completed on the client after this will report these event id back to the server.

Create a query based on those 2 event id or automatic response.

kontchr
Level 8
Report Inappropriate Content
Message 3 of 15

Re: Check if task was successful

Hi there,

there are 2 events in event filtering that are switched off by default:

1202: On-demand scan started (Info)

1203: On Demand scan  complete (Info)

Once switched on, you might be able to setup an automatic response delivering the desired result. While setting up the response select in the filter section Eventdescription = On Demand Scan completed. You'' get a description of events when you click on the " ... " button. Might do the trick 🙂

Hth,

kontchr

serc09
Level 10
Report Inappropriate Content
Message 4 of 15

Re: Check if task was successful

Thanks guys.

I'll check this and will give feedback or ask further questions.

@ kontchr: Du kannst Deutsch? Zumindest steht was in deiner Signatur...

serc09

kontchr
Level 8
Report Inappropriate Content
Message 5 of 15

Re: Check if task was successful

Es sollen ja auch alle anderen verstehen 🙂

serc09
Level 10
Report Inappropriate Content
Message 6 of 15

Re: Check if task was successful

Good morning.

I switched on:

1202: On-demand scan started (Info)

1203: On Demand scan  complete (Info)

in event filtering and reactived the agent.

Then I set up my automatic response - but i get no email.

http://img12.imageshack.us/img12/534/odsz.jpg

Anyone can help?

serc09

Nachricht geändert durch serc09 on 11/6/09 1:41 AM
kontchr
Level 8
Report Inappropriate Content
Message 7 of 15

Re: Check if task was successful

Morning,

- execute an ODS, schedule from ePO to run immediately (do it very simple so it does not scan all hard drives etc otherwise you have to wait an hour for it to finish)

- monitor on the client if it runs at all, via agent monitor for example you can see if the task is invoked, looking in to the taskmanager will show if scan32 pops up indicating ODS has started, also closely watch ...\documents and settings\all users\mcafee\comon frmaework\events

- once the scan is completed you will find event files in there, quickly take a copy before they are send to ePO

- check all the events if you can find above mentioned event ids, so we know for sure an event with matching event id has been created

- if the agent monito is still open you can send the events to ePO, by pressing the button

- simultaneously monitor on the ePO server if the eventparser parses the event successfully => eventparser log in the dn\logs folder of ePO install folder

- once parsed successfully you should receive email something, you can also check the orion log on the ePO server in the \server\logs folder around the time the event was parsed for any hints

Also have read through: KB53035, above is in principle a bit compressed, but this article contains loads of information with regards to events/notifications and how it works

regards,

kontchr

serc09
Level 10
Report Inappropriate Content
Message 8 of 15

Re: Check if task was successful

Hey.

- execute an ODS, schedule from ePO to run immediately (do it very simple so it does not scan all hard drives etc otherwise you have to wait an hour for it to finish)

That was already set up.

- monitor on the client if it runs at all, via agent monitor for example you can see if the task is invoked, looking in to the taskmanager will show if scan32 pops up indicating ODS has started, also closely watch ...\documents and settings\all users\mcafee\comon frmaework\events

Task is performed on the client as i see in the windows taskmanager but I don't have such a folder - i only have:

C:\WINDOWS\Temp\McAfeeLogs

C:\Programme\McAfee\Common Framework\  (but no "event" folder in there)

- simultaneously monitor on the ePO server if the eventparser parses the event successfully => eventparser log in the dn\logs folder of ePO install folder

In the log i don't find "1202" or "1203".

You again...

serc09
Level 10
Report Inappropriate Content
Message 9 of 15

Re: Check if task was successful

Hey, me again...

serc09 schrieb:

- monitor on the client if it runs at all, via agent monitor for example you can see if the task is invoked, looking in to the taskmanager will show if scan32 pops up indicating ODS has started, also closely watch ...\documents and settings\all users\mcafee\comon frmaework\events

Task is performed on the client as i see in the windows taskmanager but I don't have such a folder - i only have:

C:\WINDOWS\Temp\McAfeeLogs

C:\Programme\McAfee\Common Framework\  (but no "event" folder in there

I had some time and i found the event-folder under

C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\McAfee\Common Framework\AgentEvents

When ODS is started or ended, there is a *.XML-File like:

  <?xml version="1.0" encoding="UTF-8" ?> 
- <TaskStatusEvent>
- <MachineInfo>
  <MachineName>VM016061</MachineName>
  <AgentGUID>{A0392F10-EB40-4B3C-AF75-E55950794FE8}</AgentGUID>
  <IPAddress>10.140.16.61</IPAddress>
  <RawMACAddress>000C29C5DE7E</RawMACAddress>
  <OSName>Windows XP</OSName>
  <UserName>SYSTEM</UserName>
  <TimeZoneBias>-60</TimeZoneBias>
  </MachineInfo>
- <ScannerSoftware ProductName="VirusScan Enterprise" ProductVersion="8.7" ProductFamily="TVD">
  <EngineVersion>5400.1158</EngineVersion>
  <DATVersion>5796.0000</DATVersion>
  <ScannerType>ODS</ScannerType>
  <TaskName>(verwaltet) Full Scan NEU</TaskName>
  <ProductFamily>TVD</ProductFamily>
  <ProductName>VirusScan Enterprise</ProductName>
  <ProductVersion>8.7</ProductVersion>
- <TaskStatusInfo>
  <EventID>1203</EventID>
  <Severity>0</Severity>
  <GMTTime>2009-11-09T08:48:32</GMTTime>
  <UTCTime>2009-11-09T07:48:32</UTCTime>
  </TaskStatusInfo>
  </ScannerSoftware>
  </TaskStatusEvent>

The file is "gone" when events are beeing send to ePO automatically by the agent or when i push the button "send events".

But in the eventparser.log on the server, i don't find "1202" or "1203"..

Any ideas?

Greets serc09

kontchr
Level 8
Report Inappropriate Content
Message 10 of 15

Re: Check if task was successful

Thats a good thing.

In the eventparser log you would find the event file (xml) being parsed. The eventid itself,1203 or so is not recorded in the eventparser log. THere was a typo in the path sorry for that :-(.

Now that we have verified that events are generated correctly and send to ePO correctly, we can concentrate on ePO to find wether there is just a config issue or something not working correctly inside ePO.

Did you have a look through the KB article I have posted earlier too?

Regards,

kontchr

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community