Problem using server task to run client tasks off the back of a query

[rindot]

Hi all

First post here so be gentle!

I am using ePO 5.9.1 and wish to use a server task which runs a query, the results from which are a list of machines which I then want to trigger a policy-based ODS on. When I run the server task, it immediately fails and reports that it sent a Run Now task to 0 computers, even though if I run the query manually, it returns a list of machines.

Looking in orion.log on the ePO I see an error regarding the task which contains the error text :

com.mcafee.orion.core.cmd.CommandException: systemcommand.exception.unkInpTypForDatSrc

which suggests that the query is returning data that the client task is unable to work with. The query is configured to return a table with ascending AgentGUID values. Any ideas? This is driving me nuts as I thought I had it working (previously I was returning ascending System Names, changing it to AgentGUID seemed to kick it into life but now it's not working at all). This is a lab environment which is not internet-connected so getting any logs out is not possible. I have looked for the error text but found nothing.

Many thanks!

[cdinet]

If you run the query, does it actually return any results when you get that error?  Are the systems online when that runs that would be affected?  How many systems would it be sending a task to?  What is the criteria in the query that makes you want to run an ODS?  Specific events or a number of events?  You could also try using an automatic response instead.  The error seems to indicate unknown input type for data source, which is a curious error - seems to indicate some misconfiguration somewhere along the line.  Orion log would contain a little more info that just that snippet, so you might want to open a ticket with McAfee so we can take a look at the logs.

[rindot]

Hi @cdinet , thanks for replying.

Following your reply, I've gone back to the basics a little and started again. I've configured a new query as before: Managed Systems, Chart type: table based on Agent GUID (ascending). The only column being returned is Agent GUID and the filter is all Windows OS that have communicated within the last hour but not had a full ODS scan within the last 8 days. Oddly, this seems to have kicked the server task back into life with the result that it finds 9 hosts (the same as if you just run the query on its own) and ODS have been launched. I'll report back if/when the scans complete to confirm but either there was something messed up in the database regarding the original query OR when trying to use a query via a server task to launch client tasks, it's important to only return the Agent GUID. I'm not sure which of these two it is but the task is now running. Odd.

Thanks for your help though 👍

[vivs]

Hello @rindot 

Thanks for your response.

On a side note, 

You can try checking the below KB article as well :

https://kc.mcafee.com/corporate/index?page=content&id=KB69428

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

[cdinet]

The query would definitely need to be a table and typically in a scenario like that, I put the hostname (or agentguid would work) as first column so there is a reference for epo to take action on a particular system.  It may all be in the order of columns, not sure without some testing.