7 Replies Latest reply on Apr 29, 2009 8:11 AM by ateakam

    Create ePo 4.0 report for Last Scans?

      Hi guys! Using ePo 4.0 and VSE 8.7, how can I create a new query that will show me the status of the last on-demand scans and will show whether they were successful or not? I did some searching on this in the forums, and I found a couple XML queries, but couldn't get them to work.

      Thank you much!
        • 1. RE: Create ePo 4.0 report for Last Scans?
          search.... Managed Tasks
          • 2. RE: Create ePo 4.0 report for Last Scans?
            Thank you for the reply. Would you mind elaborating?
            • 3. RE: Create ePo 4.0 report for Last Scans?
              He says this in every thread. He means to search the forums for this keyword. There is one post near the top of the search that discusses this. It moves on to 3.6.x support and just briefly talks about writing the query in the 4.0 query builder.
              • 4. RE: Create ePo 4.0 report for Last Scans?
                Thank you m3_del. Yeah, I've done tons of searching on this, and am not able to find a real solution for this, hence my posting of this thread.

                I believe I had found the post that you were referring to, which was one in which Johonn had assisted with. In it, he had said:

                Create a query...
                1. Grouped Summary Table
                Groub By
                2. Event Generated Time (UTC)
                3. Analyzer Detection Method
                4. Event Description


                For my interpretation of his post, I did the following.
                -I went to the "Reporting" tab, selected "New Query"
                -For "What do you want to query for", I chose "Events"
                -For "What type of chart do you want...", I chose "Grouped Summary Table"
                -For "Group By", I chose "Analyzer Detection Method"
                -For "Group By", I chose "Event Description"

                Basically, it gave me the following, which is not particularly helpful, and requires a lot of digging around.
                Event Description Total
                Total 16
                Unable to start scheduled task. 1
                (managed) McAfee (8.7) Full AV Scan - Servers 1
                Scan was cancelled. 5
                (managed) Weekly AV (8.7) Scans - Workstations 1
                (managed) Weekly AV Scans for Workstations 1
                (managed) Weekly AV Scans for Workstations (VSE 8.7i) 1
                Full Scan 1
                On-Demand Scan 1
                On-demand scan started 1
                (managed) Weekly AV Scans for Workstations

                I'm just looking for some sort of quick, at-a-glance report to see if scans were done or not, and what the status is. And if the report would be single page, instead of only 12 items per page, so srolling through a bunch of pages wouldn't be needed.

                I'm really shocked that McAfee doesn't have some sort of pre-defined report where you can see the last scheduled scan status. It shows the "Last Update" date on the Systems page...also showing last scan would be very beneficial, and seems a pretty important piece of info to me anyways.
                • 5. RE: Create ePo 4.0 report for Last Scans?
                  Can anyone offer me any insight on this? Thank you much!
                  • 6. RE: Create ePo 4.0 report for Last Scans?
                    ummm... First off nothing is quick or easy with Mcafee. Also, no the do not offer a prepackage report to report the last scan for viruses. Why, i can only say because everyone deploys and setup their antivirus differently. The only report they could pre-package is the "Full Scan" which i bet most people here turn off or do not schedule. Not only that but you could be just scanning some files. Should that count as "last scanned" there are to many changes and options for a scan to create a report to fit everyone.


                    As for the "Last Update" well everyone has that and it is something Mcafee knows everyone has so they can report it. While i kind of like their reporting feature in ePO 4 i really wish they left the SQL option there.


                    To even add that into the reporting requires a DB scheme change which i doubt will happen since it is reported as a event and the Mcafee ePO agent picks it up and reports it.
                    • 7. RE: Create ePo 4.0 report for Last Scans?
                      Thank you very much for the reply Johonn.

                      I've used two other managed AV setups in the past, Trend Micro Office Scan and Symantec, and both have been able to report on the status of scans from what I recall (it's been a few years though since I've looked at them).

                      Looking through this forum, there's been several requests for a form such as the one I've been looking for. Undoubtedly someone has put one together that is functional. I guess I can only hope that someone will pass along their wisdom, and be willing to share the XML code for that report.

                      Thank you again for the reply.