cancel
Showing results for 
Search instead for 
Did you mean: 
RRMX
Level 7
Report Inappropriate Content
Message 1 of 9

Automatic Response for machine not checking in?

I am wondering if there is a way to configure an automatic response if a particular machine, or group of machines fails to check-in to EPO in X amount of time?

We are running EPO 4.5 and Agent 4.0.0.1494 on our managed systems. Thank you.

8 Replies
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 9

Re: Automatic Response for machine not checking in?

Absolutely - this is the same approach that the inactive agent maintenance task uses.  Simply write a query to find machines that have not communciated in <X> days, then schedule a server task to run this query and take whatever action you like

HTH -

Joe

RRMX
Level 7
Report Inappropriate Content
Message 3 of 9

Re: Automatic Response for machine not checking in?

Hmm ok... what I was looking for was if X machine hasn't checked in within the last hour, then I get a simple email that just shows which machine it is. I don't necessarily want to take any action, I just want to know which machine didn't check in. I don't want an hourly email that just shows a query... I only want to get an email if a machine in a particular group in my system tree fails to check-in.

After clicking around a bit in both Automatic Responses and in Server Tasks I still haven't figured out a way to set this up. Thanks.

McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 4 of 9

Re: Automatic Response for machine not checking in?

Ah, OK - I was thinking more of a report that tells you which machines haven't communicated within the hour, which isn't what you're after

I can't think of a way to achieve this off the top of my head - possibly some of the other contributors have a method?

Regards -

Joe

SCtbe
Level 12
Report Inappropriate Content
Message 5 of 9

Re: Automatic Response for machine not checking in?

Personally I believe that this is not possible, because Automatic Responses are based on received client or server events, and there is no event for not communicating machine.

But maybe I missed something and I'm wrong (I would like to).

Re: Automatic Response for machine not checking in?

You might be able to do this with a variation of what Joe suggested. If you setup a compliance query, filtered it down to the system you want to 'monitor', and then have a Server Task that used the query to generate a Compliance Event, then you could probably build your Automated Response off of the Compliance Event being generated.

I'll check this out when I get back to a lab environment, but I think it's possible.

SCtbe
Level 12
Report Inappropriate Content
Message 7 of 9

Re: Automatic Response for machine not checking in?

Automatic Responses cannot use queries for triggering. In other words queries cannot trigger automatic responses only events can do this.

Re: Automatic Response for machine not checking in?

It would not be a direct link from query to response. It would be more like server task (query) --> complaince event, then compliance event --> response.

Like I said last night, I'll check it out when I can get to my lab, but I think this would work.

apoling
Level 14
Report Inappropriate Content
Message 9 of 9

Re: Automatic Response for machine not checking in?

RRMX might get "overflooded" with email if clients go to sleep for the night, unless he aggregates the response to a group of such events, in which case he might as well use the simple server task method (query and email the result).

In my experience when we get too many single AR notification we tend to ignore them :-(