cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
jstanley
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 11 of 15

Re: Check if task was successful

Currently we do not have a default report that you can run to determine the success/failure of a VSE ODS. This would be a good Feature Modification request if you would like to submit one. In the meantime thier is a way you create such a report:

1.  Create a "Scan Completed" tag.
2.  Create a report to pull a list of all managed systems.
3.  Create a report to pull all 1203 events within the past <however often the ODS scan runs>.
4.  Create a server automation task.
        a.  Have the task run the query from number 2 to pull all systems and clear the "Scan Completed" tag.
        b.  Have the task run the query from number 3 to pull the 1203 events and apply the "Scan Completed" tag to all systems returned.
        b.  Schedule the task run after each on demand scan.
5.  Create a boolean chart report that shows machines with the "Scan Completed" tag as compliant, and all other machines as non-compliant.

I hope that helps!

serc09
Level 10
Report Inappropriate Content
Message 12 of 15

Re: Check if task was successful

jstanley schrieb:

Currently we do not have a default report that you can run to determine the success/failure of a VSE ODS. This would be a good Feature Modification request if you would like to submit one. In the meantime thier is a way you create such a report:

1.  Create a "Scan Completed" tag.
2.  Create a report to pull a list of all managed systems.
3.  Create a report to pull all 1203 events within the past <however often the ODS scan runs>.
4.  Create a server automation task.
        a.  Have the task run the query from number 2 to pull all systems and clear the "Scan Completed" tag.
        b.  Have the task run the query from number 3 to pull the 1203 events and apply the "Scan Completed" tag to all systems returned.
        b.  Schedule the task run after each on demand scan.
5.  Create a boolean chart report that shows machines with the "Scan Completed" tag as compliant, and all other machines as non-compliant.

I hope that helps!

Did it like that, works all fine - had some problems with the queries first....

Thank you all who helped me.

GreetZ

on 11/16/09 6:31 AM
serc09
Level 10
Report Inappropriate Content
Message 13 of 15

Re: Check if task was successful

Hey.

Me again with another problem with ID 1202 & 1203.

On 2 clients a "On Demand Scan" starts an it ends just about ~10 seconds later.

Email with ID 1202:

ePolicy Orchestrator Benachrichtigung

Ereignis-Typ: Bedrohung
Name der Antwort: Email: ODS START

Beschreibung: Schreibt eine Email-Benachrichtigung wenn ein On Demand Scan gestartet wurde

Ereignis Infos:

Anzahl: 1
Ereignis ID:1202
Schweregrad: Information
Ausgeführte Aktion: none

ePO Infos:

Gruppe: Serco
Systemort: GlobalRoot\
Ereignisempfang: 11/17/09 09:28:28 UTC
Ereignisgenerierung: 11/17/09 09:01:33 UTC

System Infos:

PC Name: PC016032
IPv6 Adresse: 10.140.16.32
IPv4 Adresse: 10.140.16.32
Betriebsystem: Windows XP Professional

Email with ID 1203:

ePolicy Orchestrator Benachrichtigung

Ereignis-Typ: Bedrohung
Name der Antwort: Email: ODS Ende

Beschreibung: Schreibt eine Email-Benachrichtigung wenn ein On Demand Scan beendet wurde

Ereignis Infos:

Anzahl: 1
Ereignis ID:1203
Schweregrad: Information
Ausgeführte Aktion: none

ePO Infos:

Gruppe: Serco
Systemort: GlobalRoot\
Ereignisempfang: 11/17/09 09:28:28 UTC
Ereignisgenerierung: 11/17/09 09:01:39 UTC

System Infos:

PC Name: PC016032
IPv6 Adresse: 10.140.16.32
IPv4 Adresse: 10.140.16.32
Betriebsystem: Windows XP Professional

It just appears on 2 clients, but thats enough to get lot of "unwanted" emails.

Any ideas?

serc09

Nachricht geändert durch serc09 on 11/17/09 8:38 AM
jstanley
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 14 of 15

Re: Check if task was successful

The two most common reasons for an ODS not to complete:

1- The user rebooted the system while the ODS was running (perhaps they noticed their computer was running a bit slow and decided to reboot)

2- The credentials used for the ODS were not valid and/or the ODS task was not able to steal the logged on credentials (because nobody was logged on) and you need to provide it credentials to run under.

If you edit the ODS task in EPO, then go to the "configuration" tab then the "task" tab you can enter credentials for the task to run under.

If none of that is helping then you should try kicking off a task locally on the machine and see what happens. This could also indicate something wrong with the VSE install in which case when you manually kick off a task it will also fail. If it turns out to be a problem with the VSE install and its only occurring on 2 machines the easiest fix will most likely be to uninstall/reinstall VSE.

I hope that helps!

serc09
Level 10
Report Inappropriate Content
Message 15 of 15

Re: Check if task was successful

serc09 schrieb:

Hey.

Me again with another problem with ID 1202 & 1203.

On 2 clients a "On Demand Scan" starts an it ends just about ~10 seconds later.

....

It just appears on 2 clients, but thats enough to get lot of "unwanted" emails.

Any ideas?

serc09

Nachricht geändert durch serc09 on 11/17/09 8:38 AM

This comes if the user right-clicks a file/folder and selects "scan for threat".

Disabled email-notification for these 2 events....

THX all

Regards

serc09

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community