This content has been marked as final. Show 4 replies
I haven't come accross this particular issue. However I do know that Snowcap is another name for the Rogue System Sensor.
Is the rogue system sensor installed on this File and Print Server? If so has it only recently been installed? And if if so, how many clients on your network?
You could try removing the sensor through ePO and adding it again.
The directory you mention is the directory that is used by the agent to store any event until it is uploaded to the ePO server.
Maybe you should increase the ASCI time or allow events to be uploaded immediately.
If you do not use the rogue system sensor, you should remove it from the server, as it will cause overhead...
as Arjen says, this should only be a temporary holding area for the events, before they are sent up to the epo server - i suspect this is masking a greater problem in that the agent isnt communicating with the epo server, and so cannot send the events up.
locate the agent_computername.log in the all usersprofile\network associates\common framework\db dir , search for the word " trial "( im assuming the log is in english !!)
it will look something like :
connecting to epo server trial 1/6 ,
is it successful, or do you see a 2/6 , 3/6 , 4/6 etc ?
incidentally, the events that you are seeing are fairly useless everytime an RSD sensor starts its "shift" it sends a sensor started message , and sends a sensor stopped message when it finishes its "shift" - these can be prevented from being created using the event filter list, which you see when you log into the reporting section using epo authentication - simply uncheck the events you are not interrested in.
I'm currently investigating the same problem. Going to post it as a separate thread.