1 2 Previous Next 17 Replies Latest reply on Mar 27, 2008 5:34 AM by Hentie

    ePO 4.0 Reports?

      I have installed ePO 4.0 on a new server. Deployed the agents and machines are reporting in. On server with exchange is set to deploy GroupShield 7.0. All systems are set to deploy McAfee ViruseScan 8.5

      Deployment are working fine, systems are updating. But now the problem.

      Nothing appears in the VirusScan and GroupShield reports including detections. One file was blocked on Exchange and one PC had infections. In both cases the detections is showing on the systems local consoles but not in the ePO reports. It's like the ePO does not know about the detections no matter what "VSE:" and "GSE 7 :" report I pull. The "ePO:" reports do contain information.

      I have remove and install all the GroupShield and VirusScan packages and the problem persist. I need to resolve this before I can continue to the next ePO server. Any Ideas?
        • 1. RE: ePO 4.0 Reports?
          metalhead
          Check the database user account which your epo uses to connect to the DB. The language for this user must be set to english. Probably you see some errors in your server.log on your epo.
          • 2. RE: ePO 4.0 Reports?
            Thanks for the response...

            But nope, not the problem. All accounts and databases are set to English, being the default also.

            We increased the memory on the ePO 4 server and the VirusScan reports started to work. The groupShield reports is still not working. I tried editing the GroupShield reports (GSE7) and found on the filter tab under "Detection Product Name" when trying to select the product, only VirusScan Enterprise is listed. No GroupShield :confused: Trying to state everything excluding VirusScan gives me no results.

            Looks like the reports doesn't even know groupshield is in the environment...
            • 3. RE: ePO 4.0 Reports?
              Hentie

              I have the same problem. Have you solved yours?

              I think it's that GSE7 isn't logging any events into the ePO event log. The "Detecting Product ID" dialog is headed "Choose from existing values" ie (I think) what has been logged - not what products ePO thinks is installed.
              • 4. RE: ePO 4.0 Reports?
                Hi

                Sorry, no solution. I am running now two ePO 4.0 servers in different network. Same problem on both.
                • 5. RE: ePO 4.0 Reports?
                  Something new...

                  I have one server running MSDE, SQL Server 2005 Express. This server's GroupShield 7 is reporting back.
                  The other servers are running from a remote SQL 2005 database server. Might this be the reason?

                  I unfortunately do not have a lab to test this out in.
                  • 6. RE: ePO 4.0 Reports?
                    I have the same problem. I think, the problem is follow: GroupShield documentation says that two extensions should be installed that GroupShield can be managed by ePolicy Orchestrator 4.0:
                    - GROUPSHD7000.ZIP
                    - GSE7REPORTS.ZIP

                    First extension is in the installation package and when I've installed this, EPO has become able to configure GroupShield.
                    But second extension is not in the installation package. I think, using this extension we will be able to receive events from GroupShield.

                    More, I've viewed EPO log-files. Here is errors during events parsing:
                    --
                    20080205182024 E #1828 EventParser EventParser::PluginCache - Can't find RootElement 'GS Exchange::7.0.0' in registered event types
                    --
                    It means that GroupShield events are not in the list of supported. I've check table EPORepositoryLogMessage (it contains the list of supported events) and that I've seen: for example, for GroupShield 6.0.0 there is the row:
                    GS Exchange::6.0.0, GSE6REPORTS/gseeventparser.dll

                    first column is the name of product, second - I think is the parser and where is saved. As you can see, the name of folder is GSE6REPORTS.
                    So, I think, we need to find GSE7REPORTS extension.
                    • 7. RE: ePO 4.0 Reports?
                      I have the same problem. I think, the problem is follow: GroupShield documentation says that two extensions should be installed that GroupShield can be managed by ePolicy Orchestrator 4.0:
                      - GROUPSHD7000.ZIP
                      - GSE7REPORTS.ZIP

                      First extension is in the installation package and when I've installed this, EPO has become able to configure GroupShield.
                      But second extension is not in the installation package. I think, using this extension we will be able to receive events from GroupShield.

                      More, I've viewed EPO log-files. Here is errors during events parsing:
                      --
                      20080205182024 E #1828 EventParser EventParser::PluginCache - Can't find RootElement 'GS Exchange::7.0.0' in registered event types
                      --
                      It means that GroupShield events are not in the list of supported. I've check table EPORepositoryLogMessage (it contains the list of supported events) and that I've seen: for example, for GroupShield 6.0.0 there is the row:
                      GS Exchange::6.0.0, GSE6REPORTS/gseeventparser.dll

                      first column is the name of product, second - I think is the parser and where is saved. As you can see, the name of folder is GSE6REPORTS.
                      So, I think, we need to find GSE7REPORTS extension.
                      • 8. RE: ePO 4.0 Reports?
                        Might be possible...

                        What I notice is that on MSDE (SQL 2005 Express) GroupShield reports are there. On SQL 2005 Standard on a remote server the reports are not the same.
                        Between these two server the only difference is the SQL. Might be the SQL link with ePO being the problem.

                        I'm trying to arrange for a lab to test this out as the servers mentioned was only tested on MSDE before deployment.

                        Q... Are you running from SQL 2005 Express (The version that shipped with ePO 4) or a separate SQL?
                        • 9. RE: ePO 4.0 Reports?
                          I use MS SQL server 2000 running on separate machine...
                          1 2 Previous Next