Is it possible for ePo server , RDS sensor or another mcafee product to detect if virusScan is running on a computer with information about virusScan version and Dat version installed?
There are some canned reports in the dashboard that will give you an idea about the dat adoption rate, or compliance for about if the product is loaded or not. There is not to my knowledge a report or query that exists that will actually show if the on access scanner is started or working. You might could create a query that would look for the event 1127 this event is " OAS scanning engine disabled" This should show a list of computers that do not have the on access scanner running.
Thanks for your answer.
Is it possible to send a reports(ex: about the dat adoption rate or product compliance) by mail ?
Yes, it is. Please see the "Running a query on a schedule" section of the product guide for more details.
This can be accomplished by completing the following:
Next we need to configure the epo_server to talk to the email server.
Thanks Williams for these information.
I don't understand something.
The query associated to task "VSE: Dat adoption over the last 24 hours" is "VSE Current Dat adoption". the Criteria of these query is :
"Product Version (VirusScan Enterprise) Equals "8.0" or Product Version (VirusScan Enterprise) Equals "8.5" or Product Version (VirusScan Enterprise) Equals "8.7"
I don't undersand how this query help to assign as non-compliant, systems with DAT and engine which is not up to date.
There is also the compliant / non-compliant criteria, which is defined as "VSE Dat version is within 1 version of the repository version", so the whole query effectively means "mark as compliant any machines with VSE 8, 8.5 or 8.7 that have a dat version within 1 version of the repository version."
Joe is correct. I guess I should have explained that my steps only talked about how to schedule the query to run and send an email. The query has criteria that would need to be defined or checked to make sure that it meets you compliance needs.
This is ok for the report about laptop which DAT version is not up to date.
But the detection of on access scanning does not work.
I have enable detection of events:
1088: on access scan stopped(info)
1091: OAS stopped(info)
1127: OAS Scanning engine disabled(info)
I have launched a wake up from ePO server to my computer.
the mcafee agent of my computer sent every 5 mns detected event to ePO sever.
I disabled the on access scanning on my computer but no events 1088,1091,1127 were sent to the servers.
Can you help me to fix this last point ?