On a 550 pc setup, we have a complete scan schedule on every thursday at noon. I want ot make a query to find out wich pc did not scan last time. I can make a query to find out wich did, but when i try to make a boolean query of the one who did vs the one who did not, i get like thousand of result for the not. These result include all the other event id except the 1203 ( wich is the one i used to find out if the scan ran )
Any idea how i would make a query on the manage pc that did not received a 1203 in the last week. Seem pretty easy but im missing something....
First of all you need to check wheather you have enabled Event ID's 1202 (On-Demand Scan Started) & 1203 (On-Demand Scan Completed).
For this setting you need to login ePO server--->Menu--->Configuration--->Server Setting--->Event Filtering--->Edit--->Select Event ID 1202 & 1203.
Then you can use the below Attached Query . It worked for me..
Hope this will also help you..
Thanks, however, that gives me the one that did the scan. Not the one that did not scan.
Also, it seem i got two result for each node.one for each event id. Is there a way to have one result for each ?
This worked for me, just needed to change Analyzer Detection Method to my ODS task names,
Also split the 1202 and 1203 events for comparison
Message was edited by: BlackDiamond on 2011/09/29 10:57:48 AMMessage was edited by: BlackDiamond on 2011/09/29 10:58:17 AM