cancel
Showing results for 
Search instead for 
Did you mean: 
Omriil
Level 8
Report Inappropriate Content
Message 1 of 3

DB column "OSServicePackVer" disappeared on ePO 5.10

Jump to solution

Hi,

our customer is pulling data to SIEM from the ePO DB.

we made an upgrade from 5.3.1 to 5.10 and now we can't find the column "OSServicePackVer" at the table EPOComputerProperties 

we know from other sites that this column exists in 5.9.1, is it possible that it was moved/removed in 5.10?

 

1 Solution

Accepted Solutions
McAfee Employee Hawkmoon
McAfee Employee
Report Inappropriate Content
Message 3 of 3

Re: DB column "OSServicePackVer" disappeared on ePO 5.10

Jump to solution

Hi Omriil, (and so to add!) 

The column isn't missing and hasn't been removed, it’s been renamed!

Below are two queries, one from ePO 5.9 the other 5.10, they are asking only for the 'service pack' details of the devices in the managed estate.

Query from ePO 5.9.

select [EPOLeafNode].[AgentGUID], [EPOLeafNode].[AutoID] from [EPOLeafNode] left join [EPOComputerProperties] on [EPOLeafNode].[AutoID] = [EPOComputerProperties].[ParentID] where ( ( [EPOComputerProperties].[OSServicePackVer] is null or ltrim( rtrim( [EPOComputerProperties].[OSServicePackVer] ) ) = '' ) or ( not ( [EPOComputerProperties].[OSServicePackVer] is null or ltrim( rtrim( [EPOComputerProperties].[OSServicePackVer] ) ) = '' ) ) ) order by [EPOLeafNode].[AgentGUID] asc

The column name is defined as expected- OSServicePackVer

Query from ePO 5.10

select [EPOLeafNode].[LastUpdate], [EPOLeafNode].[NodeName], [EPOLeafNode].[AutoID] from [EPOLeafNode] left join [EPOComputerProperties] on [EPOLeafNode].[AutoID] = [EPOComputerProperties].[ParentID] where ( ( [EPOComputerProperties].[OSCsdVersion] is null or ltrim( rtrim( [EPOComputerProperties].[OSCsdVersion] ) ) = '' ) or ( not ( [EPOComputerProperties].[OSCsdVersion] is null or ltrim( rtrim( [EPOComputerProperties].[OSCsdVersion] ) ) = '' ) ) ) order by [EPOLeafNode].[LastUpdate] asc

The column name is defined here as - OSCsdVersion

 

In line with the details and contents of the 'client' device.

For example the details can be collected 'locally' via WMI:        wmic os get Caption,CSDVersion /value

or via Powereshell.
Ref:

https://docs.microsoft.com/en-us/dotnet/api/microsoft.powershell.commands.computerinfo.oscsdversion?...

Best speak with the SIEM team to see about having the default query (if this a default query) updated, else if it’s a custom creation simply swap the names out.

Was my reply helpful?

If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

2 Replies
McAfee Employee cdinet
McAfee Employee
Report Inappropriate Content
Message 2 of 3

Re: DB column "OSServicePackVer" disappeared on ePO 5.10

Jump to solution

I tested it on my system - try using column name OScsdversion instead

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

McAfee Employee Hawkmoon
McAfee Employee
Report Inappropriate Content
Message 3 of 3

Re: DB column "OSServicePackVer" disappeared on ePO 5.10

Jump to solution

Hi Omriil, (and so to add!) 

The column isn't missing and hasn't been removed, it’s been renamed!

Below are two queries, one from ePO 5.9 the other 5.10, they are asking only for the 'service pack' details of the devices in the managed estate.

Query from ePO 5.9.

select [EPOLeafNode].[AgentGUID], [EPOLeafNode].[AutoID] from [EPOLeafNode] left join [EPOComputerProperties] on [EPOLeafNode].[AutoID] = [EPOComputerProperties].[ParentID] where ( ( [EPOComputerProperties].[OSServicePackVer] is null or ltrim( rtrim( [EPOComputerProperties].[OSServicePackVer] ) ) = '' ) or ( not ( [EPOComputerProperties].[OSServicePackVer] is null or ltrim( rtrim( [EPOComputerProperties].[OSServicePackVer] ) ) = '' ) ) ) order by [EPOLeafNode].[AgentGUID] asc

The column name is defined as expected- OSServicePackVer

Query from ePO 5.10

select [EPOLeafNode].[LastUpdate], [EPOLeafNode].[NodeName], [EPOLeafNode].[AutoID] from [EPOLeafNode] left join [EPOComputerProperties] on [EPOLeafNode].[AutoID] = [EPOComputerProperties].[ParentID] where ( ( [EPOComputerProperties].[OSCsdVersion] is null or ltrim( rtrim( [EPOComputerProperties].[OSCsdVersion] ) ) = '' ) or ( not ( [EPOComputerProperties].[OSCsdVersion] is null or ltrim( rtrim( [EPOComputerProperties].[OSCsdVersion] ) ) = '' ) ) ) order by [EPOLeafNode].[LastUpdate] asc

The column name is defined here as - OSCsdVersion

 

In line with the details and contents of the 'client' device.

For example the details can be collected 'locally' via WMI:        wmic os get Caption,CSDVersion /value

or via Powereshell.
Ref:

https://docs.microsoft.com/en-us/dotnet/api/microsoft.powershell.commands.computerinfo.oscsdversion?...

Best speak with the SIEM team to see about having the default query (if this a default query) updated, else if it’s a custom creation simply swap the names out.

Was my reply helpful?

If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

More McAfee Tools to Help You

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community