Skip navigation
McAfee Secure sites help keep you safe from identity theft, credit card fraud, spyware, spam, viruses and online scams
751 Views 9 Replies Latest reply: Jul 23, 2013 9:58 AM by stev379 RSS
stev379 Newcomer 32 posts since
May 8, 2007
Currently Being Moderated

Jul 18, 2013 11:36 AM

Query returns different number of total systems

Why is the total system count so high on my 8.7 query? I run AD discovery nightly and clean up disconnected systems regularly.

 

If run 2 queries, one for 8.7 and one for 8.8, I get widely different totals. Why?

 

I know many of these system have not been online for a while. I don't care about the 8.7 stuff being non-compliant. I get why that is, but I don't understand why the total counts are different.

 

8.7 query = 2741 Non-Compliant

8.8 query = 615 Compliant  &  4 Non-Compliant

There's over 2100 more machines being reported on from the 8.7 query

 

CRITERIA

8.7 Boolean Pie

Pie slices are number of managed systems

VirusScan Product Version is Greater than or equals - 8.7

AND Less than 8.8

RESULT --> 2741 Non-Compliant

 

8.8 Boolean Pie

Pie slices are number of managed systems

VirusScan Product Version is Greater than or equals - 8.8

AND Less than 8.9

RESULT --> 615 Compiant & 4 Non-Compliant

 

 

 

ePO 4.6.3 (build 197) on Win 2k3

XP and Win 7 desktops

Using VirusScan 8.8 and previous had 8.7...a couple years ago.

 

Thanks!

  • Laszlo G Veteran 1,213 posts since
    May 23, 2007
    Currently Being Moderated
    1. Jul 19, 2013 1:32 AM (in response to stev379)
    Re: Query returns different number of total systems

    So you mean that the 8.7 query shows any computer as non-compliant? If that's right then you must not have computers with VirusScan 8.7 or you forgot to install VirusScan 8.7 management extension into ePO.

     

    Remeber also that your 8.7 query will show any VSE 8.8 computer as non-compliant and vice-versa with 8.8 query

  • Tristan Veteran 790 posts since
    Dec 8, 2009
    Currently Being Moderated
    2. Jul 19, 2013 3:42 AM (in response to Laszlo G)
    Re: Query returns different number of total systems

    First question is how many machines are you actually managing in ePO? e.g. In your system tree select 'My Organization' and change the preset to 'This Group and All Subgroups' how many items are listed?

     

    Sometimes machines get dumped in 'Lost&Found'

     

    What results do you get with the default ePO Queries?

  • Tristan Veteran 790 posts since
    Dec 8, 2009
    Currently Being Moderated
    4. Jul 19, 2013 4:28 AM (in response to stev379)
    Re: Query returns different number of total systems

    Post the SQL of your query. 2741 is roughly x4 your number of systems so it's possible there's a JOIN in the query that's multiplying the system count.

     

    Tick the query and in the 'Actions' button there will be an option to 'view SQL'

  • Tristan Veteran 790 posts since
    Dec 8, 2009
    Currently Being Moderated
    7. Jul 19, 2013 5:55 AM (in response to stev379)
    Re: Query returns different number of total systems

    It looks like your queries are cross joining the RSDDetectedSystems tables. Try flushing out any computers listed in 'Detected systems' and see if it changes the results.

  • JoeBidgood McAfee SME 2,868 posts since
    Sep 11, 2009
    Currently Being Moderated
    8. Jul 19, 2013 9:43 AM (in response to Tristan)
    Re: Query returns different number of total systems

    That's a good catch, Tristan

    Another approach is to remove the RSD components from the query. They are being added by the query builder either on the Columns or Filter page - edit the query and remove any columns that are part of the Detected Systems section of the Available Columns or Available Properties lists. It's unlikely that you'd need these columns as part of a compliance query.

    If you're not sure which columns are the culprits, please export the two queries and attach the xml files here, and we can take a look.

     

    HTH -

     

    Joe




    (Please post questions to the forum, as I am unable to respond to private messages. Thanks!)



More Like This

  • Retrieving data ...

Bookmarked By (0)

Legend

  • Correct Answers - 5 points
  • Helpful Answers - 3 points