cancel
Showing results for 
Search instead for 
Did you mean: 

Is it possible for ePo server or RDS sensor to detect if virusScan process is running

Hello,

Is it possible for ePo server , RDS sensor or another mcafee product to detect if virusScan is running on a computer   with information about virusScan version and Dat version installed?

Regards

Ghislaine

9 Replies
wsanford
Level 10
Report Inappropriate Content
Message 2 of 10

Re: Is it possible for ePo server or RDS sensor to detect if virusScan process is running

Ghislaine,


There are some canned reports in the dashboard that will give you an idea about the dat adoption rate, or compliance for about if the product is loaded or not. There is not to my knowledge a report or query that exists that will actually show if the on access scanner is started or working. You might could create a query that would look for the event 1127 this event is " OAS scanning engine disabled"  This should show a list of computers that do not have the on access scanner running.

thanks

William

Re: Is it possible for ePo server or RDS sensor to detect if virusScan process is running

Hello Williams,

Thanks for your answer.

Is it possible to send a reports(ex: about  the dat adoption rate or product compliance) by mail ?

Regards

Ghislaine

McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 4 of 10

Re: Is it possible for ePo server or RDS sensor to detect if virusScan process is running

Yes, it is. Please see the "Running a query on a schedule" section of the product guide for more details.

HTH -

Joe

wsanford
Level 10
Report Inappropriate Content
Message 5 of 10

Re: Is it possible for ePo server or RDS sensor to detect if virusScan process is running

Ghislaine.balifi,

This can be accomplished by completing the following:

  • Login to the ePO dashboard
  • Click Menu / Automation / Server Tasks
  • * You can enable the default task "VSE: Dat adoption over the last 24 hours" or create a new task *
  • Click edit for the VSE: Dat adoption over the last 24 hours.
  • Under Schedule status: click Enabled.
  • Click Next.
  • On the next page under the Sub-Action box  click the down arrow and choose Email file.
  • You will need to fill in the blanks for Recipients, Subject. There are other options but they are up to you.
  • Click Next.
  • On the schedule option, Click the down arrow for Schedule type and choose daily. Configure when you want this task to run.
  • Click Next.
  • Then Save.

Next we need to configure the epo_server to talk to the email server.

  • Menu / configuration / Server Settings / Email Server
  • Click edit
  • Configure this screen with the email server name and port and authentication creditials.

thanks

William

Re: Is it possible for ePo server or RDS sensor to detect if virusScan process is running

Thanks Williams for these information.

I don't understand something.

The query associated to task "VSE: Dat adoption over the last 24 hours"  is "VSE Current Dat adoption". the Criteria of these query is :

"Product Version (VirusScan Enterprise) Equals "8.0" or Product Version (VirusScan Enterprise) Equals "8.5" or Product Version (VirusScan Enterprise) Equals "8.7"

I don't undersand how this query help to assign as non-compliant, systems with DAT and engine which is not up to date.


Regards

Ghislaine

McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 7 of 10

Re: Is it possible for ePo server or RDS sensor to detect if virusScan process is running

There is also the compliant / non-compliant criteria, which is defined as "VSE Dat version is within 1 version of the repository version", so the whole query effectively means "mark as compliant any machines with VSE 8, 8.5 or 8.7 that have a dat version within 1 version of the repository version."

HTH -

Joe

Re: Is it possible for ePo server or RDS sensor to detect if virusScan process is running

Yes,

You are right.

Ghislaine

wsanford
Level 10
Report Inappropriate Content
Message 9 of 10

Re: Is it possible for ePo server or RDS sensor to detect if virusScan process is running

Ghislaine,

Joe is correct. I guess I should have explained that my steps only talked about how to schedule the query to run and send an email. The query has criteria that would need to be defined or checked to make sure that it meets you compliance needs.

thanks

William

Re: Is it possible for ePo server or RDS sensor to detect if virusScan process is running

Thanks,

This is ok for  the report about laptop which DAT version is not up to date.

But the detection of on access scanning does not work.

I have enable detection of events:

1088: on access scan stopped(info)

1091: OAS stopped(info)

1127:  OAS Scanning engine disabled(info)

I have launched a wake up from ePO server to my computer.

the mcafee agent of my computer sent every 5 mns detected event to ePO sever.

I disabled the on access scanning on my computer but no events 1088,1091,1127 were sent to the servers.

Can you help me to fix this last point ?

Regards

Ghislaine