1 Reply Latest reply on Feb 11, 2010 8:09 AM by Attila Polinger

    EPO4.0 Reports query problem

      Hello all,

       

      I'm fairly new to the EPO world so forgive me if this is a silly question.

       

      I'm trying to create a report query that will display problem assets that aren't updating their .DAT

      I can create a simple query showing if the .DAT is out of date and if the client asset has recently been in communication with EPO.

      However because of the 60min delay between agent - server communication its displaying assets in the report before they've reported back that they've got an updated .DAT.

       

      What I really want is to show assets that have been in regular contact with the EPO server but are not updating their .DAT file..therefore suggesting that there is an issue with the client. But as there's only a single time stamp (last update time) I'm not sure how I can do this..?

       

      Any suggestions?? Help?

       

      thanks in advance

        • 1. Re: EPO4.0 Reports query problem
          Attila Polinger

          Hello,

           

          assuming you are familiar with report creation:

           

          you can create a new query, for example a boolean pie chart, from Managed Systems where the criteria for compliant systems are as follows:

           

          - DAT versions\VirusScan Enterprise Properties is within X versions of repository, X=1

          AND

          - Last Update is not within 1 hour AND is within 2 hours

           

          Assuming the 60 min. ASCI, some systems can report on the hour while others can report within an hour; I suppose this is a fair interpolation to a up to date status.

          The non-compliant half of the boolean chart represents systems that might have problems updating. Also, there could be rare problems with filling in fields in ePO database sometimes, so you might see systems here with blank or irregularly formatted DAT version, that were taken as non-compliant. These systems need to get checked manually.

           

          You may get a combined number of less than the actual number of hosts, since non-contacting/down hosts will be missing from this report not qualifying for the double criteria.

           

          Attila

          1 of 1 people found this helpful