cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Former Member
Not applicable
Report Inappropriate Content
Message 1 of 10

Is it possible for ePo server or RDS sensor to detect if virusScan process is running

Hello,

Is it possible for ePo server , RDS sensor or another mcafee product to detect if virusScan is running on a computer   with information about virusScan version and Dat version installed?

Regards

Ghislaine

9 Replies
Former Member
Not applicable
Report Inappropriate Content
Message 2 of 10

Re: Is it possible for ePo server or RDS sensor to detect if virusScan process is running

Ghislaine,


There are some canned reports in the dashboard that will give you an idea about the dat adoption rate, or compliance for about if the product is loaded or not. There is not to my knowledge a report or query that exists that will actually show if the on access scanner is started or working. You might could create a query that would look for the event 1127 this event is " OAS scanning engine disabled"  This should show a list of computers that do not have the on access scanner running.

thanks

William

Former Member
Not applicable
Report Inappropriate Content
Message 3 of 10

Re: Is it possible for ePo server or RDS sensor to detect if virusScan process is running

Hello Williams,

Thanks for your answer.

Is it possible to send a reports(ex: about  the dat adoption rate or product compliance) by mail ?

Regards

Ghislaine

JoeBidgood
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 4 of 10

Re: Is it possible for ePo server or RDS sensor to detect if virusScan process is running

Yes, it is. Please see the "Running a query on a schedule" section of the product guide for more details.

HTH -

Joe

Former Member
Not applicable
Report Inappropriate Content
Message 5 of 10

Re: Is it possible for ePo server or RDS sensor to detect if virusScan process is running

Ghislaine.balifi,

This can be accomplished by completing the following:

  • Login to the ePO dashboard
  • Click Menu / Automation / Server Tasks
  • * You can enable the default task "VSE: Dat adoption over the last 24 hours" or create a new task *
  • Click edit for the VSE: Dat adoption over the last 24 hours.
  • Under Schedule status: click Enabled.
  • Click Next.
  • On the next page under the Sub-Action box  click the down arrow and choose Email file.
  • You will need to fill in the blanks for Recipients, Subject. There are other options but they are up to you.
  • Click Next.
  • On the schedule option, Click the down arrow for Schedule type and choose daily. Configure when you want this task to run.
  • Click Next.
  • Then Save.

Next we need to configure the epo_server to talk to the email server.

  • Menu / configuration / Server Settings / Email Server
  • Click edit
  • Configure this screen with the email server name and port and authentication creditials.

thanks

William

Former Member
Not applicable
Report Inappropriate Content
Message 6 of 10

Re: Is it possible for ePo server or RDS sensor to detect if virusScan process is running

Thanks Williams for these information.

I don't understand something.

The query associated to task "VSE: Dat adoption over the last 24 hours"  is "VSE Current Dat adoption". the Criteria of these query is :

"Product Version (VirusScan Enterprise) Equals "8.0" or Product Version (VirusScan Enterprise) Equals "8.5" or Product Version (VirusScan Enterprise) Equals "8.7"

I don't undersand how this query help to assign as non-compliant, systems with DAT and engine which is not up to date.


Regards

Ghislaine

JoeBidgood
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 7 of 10

Re: Is it possible for ePo server or RDS sensor to detect if virusScan process is running

There is also the compliant / non-compliant criteria, which is defined as "VSE Dat version is within 1 version of the repository version", so the whole query effectively means "mark as compliant any machines with VSE 8, 8.5 or 8.7 that have a dat version within 1 version of the repository version."

HTH -

Joe

Former Member
Not applicable
Report Inappropriate Content
Message 8 of 10

Re: Is it possible for ePo server or RDS sensor to detect if virusScan process is running

Yes,

You are right.

Ghislaine

Former Member
Not applicable
Report Inappropriate Content
Message 9 of 10

Re: Is it possible for ePo server or RDS sensor to detect if virusScan process is running

Ghislaine,

Joe is correct. I guess I should have explained that my steps only talked about how to schedule the query to run and send an email. The query has criteria that would need to be defined or checked to make sure that it meets you compliance needs.

thanks

William

Former Member
Not applicable
Report Inappropriate Content
Message 10 of 10

Re: Is it possible for ePo server or RDS sensor to detect if virusScan process is running

Thanks,

This is ok for  the report about laptop which DAT version is not up to date.

But the detection of on access scanning does not work.

I have enable detection of events:

1088: on access scan stopped(info)

1091: OAS stopped(info)

1127:  OAS Scanning engine disabled(info)

I have launched a wake up from ePO server to my computer.

the mcafee agent of my computer sent every 5 mns detected event to ePO sever.

I disabled the on access scanning on my computer but no events 1088,1091,1127 were sent to the servers.

Can you help me to fix this last point ?

Regards

Ghislaine

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community