RO55 1 Posted February 23, 2017 Share Posted February 23, 2017 Hi there, we're experiencing a strange problem with ERA 6.4. Every few days some of our policies 'lose' their assigned clients. These are specific policies assigned to one host each. This happens randomly to different policies. When I re-assign the host to the policy everything is fine until some other policies lose their targets. I have to check this every day now and would rather do more entertaining things... Any help would be much appreciated! Thanks, RO55 Link to comment Share on other sites More sharing options...
ESET Staff MichalJ 434 Posted February 23, 2017 ESET Staff Share Posted February 23, 2017 Hello, by "host" you mean "computer" ? So basically, if the policy is assigned to a computer XYZ you say, that the policy assignments are lost without any user interaction? Is anything reported in the audit-log? Wasn´t the computer removed and re-added to the ERA? Link to comment Share on other sites More sharing options...
RO55 1 Posted February 23, 2017 Author Share Posted February 23, 2017 Yes, that's exactly what's happening. Since I am the only one using ERA I am pretty sure, there was no user interaction... The computers were not re-added, at least not manually. Where can I find the audit-log? Link to comment Share on other sites More sharing options...
ESET Staff MichalJ 434 Posted February 23, 2017 ESET Staff Share Posted February 23, 2017 In "reports" section, under the "Remote Administrator management" category. Link to comment Share on other sites More sharing options...
RO55 1 Posted February 23, 2017 Author Share Posted February 23, 2017 I get a 9000ms timeout when I try to generate the report. Do I have to tweak the report to get an audit-log? Link to comment Share on other sites More sharing options...
ESET Staff MichalJ 434 Posted February 23, 2017 ESET Staff Share Posted February 23, 2017 Ouch, you should ideally limit the number of entries to last XYZ entries (ideally to some 1000-5000 entries). PS: This 9000ms timeout will be resolved as soon as ERA 6.5 is out, there are some tweaks in both the console and the database. Link to comment Share on other sites More sharing options...
RO55 1 Posted March 2, 2017 Author Share Posted March 2, 2017 I tried to limit the entries, but even with a range of 100 I get the timeout. Or is "Report Range" the wrong place to limit the entries? Link to comment Share on other sites More sharing options...
ESET Staff MartinK 384 Posted March 6, 2017 ESET Staff Share Posted March 6, 2017 Could you please enable full trace log verbosity (Admin -> Server settings) + try to generate this report few times + wait for timeout error and send me generated trace log as private message? We would also appreciate more details of your environment, especially DB type (MySQL?, SQLServer?), platform (windows? linux appliance?, custom linux?) and RAM available to both ERA and database itself if separated. Link to comment Share on other sites More sharing options...
RO55 1 Posted March 13, 2017 Author Share Posted March 13, 2017 Where do I find the trace logs after enabling? Link to comment Share on other sites More sharing options...
ESET Staff MartinK 384 Posted March 16, 2017 ESET Staff Share Posted March 16, 2017 Logs will be located most probably in: C:\ProgramData\ESET\RemoteAdministrator\Agent\EraAgentApplicationData\Logs in case of Windows ERA installation. Regarding your issue: Is it possible that computer that looses assigned policies was removed? There are two SERVER task that could cause silent removal of computer: Static Group Synchronization (AD/LDAP) task may remove computers that are no longer existing in AD Delete Not Connecting Computers will delete computer that have not connected for specified time. In case active (i.e. connecting) AGENT is removed, it will be automatically re-created with the same name and in the same hierarchy location, but it will loose assigned object as are policies and tasks. Please check configuration of mentioned tasks in case you are using them. Link to comment Share on other sites More sharing options...
Recommended Posts