Policies 'losing' assigned clients

[RO55 1]

Hi there,

we're experiencing a strange problem with ERA 6.4.

Every few days some of our policies 'lose' their assigned clients. These are specific policies assigned to one host each. This happens randomly to different policies. When I re-assign the host to the policy everything is fine until some other policies lose their targets.

I have to check this every day now and would rather do more entertaining things...

Any help would be much appreciated!

Thanks,
RO55

[MichalJ 434]

Hello, by "host" you mean "computer" ? So basically, if the policy is assigned to a computer XYZ you say, that the policy assignments are lost without any user interaction? Is anything reported in the audit-log? Wasn´t the computer removed and re-added to the ERA? 

[RO55 1]

Yes, that's exactly what's happening. Since I am the only one using ERA I am pretty sure, there was no user interaction...
The computers were not re-added, at least not manually.

Where can I find the audit-log?

[MichalJ 434]

In "reports" section, under the "Remote Administrator management" category. 

[RO55 1]

I get a 9000ms timeout when I try to generate the report. Do I have to tweak the report to get an audit-log?

[MichalJ 434]

Ouch, you should ideally limit the number of entries to last XYZ entries (ideally to some 1000-5000 entries).

PS: This 9000ms timeout will be resolved as soon as ERA 6.5 is out, there are some tweaks in both the console and the database.

 

[RO55 1]

I tried to limit the entries, but even with a range of 100 I get the timeout. Or is "Report Range" the wrong place to limit the entries?

[MartinK 378]

Could you please enable full trace log verbosity (Admin -> Server settings) + try to generate this report few times + wait for timeout error and send me generated trace log as private message?

We would also appreciate more details of your environment, especially DB type (MySQL?, SQLServer?), platform (windows? linux appliance?, custom linux?) and RAM available to both ERA and database itself if separated.

[RO55 1]

Where do I find the trace logs after enabling?

[MartinK 378]

Logs will be located most probably in:

C:\ProgramData\ESET\RemoteAdministrator\Agent\EraAgentApplicationData\Logs

in case of Windows ERA installation.

Regarding your issue: Is it possible that computer that looses assigned policies was removed? There are two SERVER task that could cause silent removal of computer:

1. Static Group Synchronization (AD/LDAP) task may remove computers that are no longer existing in AD
2. Delete Not Connecting Computers will delete computer that have not connected for specified time.

In case active (i.e. connecting) AGENT is removed, it will be automatically re-created with the same name and in the same hierarchy location, but it will loose assigned object as are policies and tasks. Please check configuration of mentioned tasks in case you are using them.