1 Reply Latest reply on Jan 29, 2010 4:22 PM by wwarren

    Event ID: 21027 not in email notification

    1006

      Hi there,

       

      Im running ePO 4.0 and from time to time a specific user pops up in my Top 10 Users with most detections..  For some how Im not recieving an email notification of this malware being detected,, Its Event  21027.. Could it be possible that this user managed to exclude himself from these notifications? He is an executive reviewer..

       

      Thanks         

        • 1. Re: Event ID: 21027 not in email notification
          wwarren

          The event in question is saying we successfully found and deleted some malware. The user has the antispyware module installed.

           

          The question on whether an Executive Reviewer can make a change to your notification rule is best answered by the ePO forum, or you could call McAfee Support.

          On my server, an Executive Reviewer can only view events.

           

          From what you describe, the events are still in the database, else he wouldn't show up in your Top 10 Users with most detections.

          It sounds like something is amiss in the Notifications mechanism triggering off the received event.