ShaneDT 13 Posted October 8, 2018 Share Posted October 8, 2018 Initially I had a single report scheduled to run every Monday at 8am. This seemed to be working fine for a couple of weeks. I then added an additional report to also run every Monday at 8am (to different recipients). Since creating this second report neither report is running automatically. I'm having to login and select Run Now to generate the reports. Initially I though maybe a bug having them both run at the same time, so changed one to run at 8:01am. Still fails to run automatically. I assume this is a bug? Thanks. Link to comment Share on other sites More sharing options...
ESET Staff MichalJ 434 Posted October 8, 2018 ESET Staff Share Posted October 8, 2018 @ShaneDT Thanks for reporting. We will try to replicate this issue on our internal QA. As of now, I can´t comment about a possible reason, as I am unaware of such behavior. Can you post a screenshot of a precise trigger configuration? You can also send me that via private message. Link to comment Share on other sites More sharing options...
ESET Staff MartinK 378 Posted October 10, 2018 ESET Staff Share Posted October 10, 2018 On 10/8/2018 at 2:48 AM, ShaneDT said: Initially I had a single report scheduled to run every Monday at 8am. This seemed to be working fine for a couple of weeks. I then added an additional report to also run every Monday at 8am (to different recipients). Since creating this second report neither report is running automatically. I'm having to login and select Run Now to generate the reports. Initially I though maybe a bug having them both run at the same time, so changed one to run at 8:01am. Still fails to run automatically. I assume this is a bug? Thanks. Could you please try to restart ESMC service and check whether it helps? We have recently discovered issue with detection of time-shift, which might result in state where scheduled events are missed. Link to comment Share on other sites More sharing options...
ShaneDT 13 Posted October 11, 2018 Author Share Posted October 11, 2018 Will try a restart in the next couple of days, sorry guys haven't had any time to test this further. Link to comment Share on other sites More sharing options...
ShaneDT 13 Posted October 15, 2018 Author Share Posted October 15, 2018 I did a complete server restart on Thursday. Interestingly the restart triggered the scheduled reports to run. These were date and time stamped at the time of the restart, not from the previous scheduled time (ie Monday 8am). I decided to then leave it and see if the scheduled reports then ran at 8:00am and 8:01am as scheduled on Monday morning this week. Nothing. I then decided to install the latest Microsoft updates to my server this morning, restarted the server, and again on restart the scheduled reports were triggered. So resetting the services / restarting the server, made no difference to the scheduled reports running when scheduled. Worse, now it looks like every time I restart the server it's going to send out reports when it shouldn't. Embarrassing to explain to the customer why reports that are scheduled for 8am Monday mornings aren't running, but instead seem to run randomly. Link to comment Share on other sites More sharing options...
ESET Staff MartinK 378 Posted October 15, 2018 ESET Staff Share Posted October 15, 2018 Regarding reports are generated after reboot, could you verify configuration parameter "Invoke ASAP If Event Missed" of your triggers? In case this flag is enabled, it would explain why reports are sent after reboot. Link to comment Share on other sites More sharing options...
Pinni3 21 Posted October 15, 2018 Share Posted October 15, 2018 This issue is related to the one with hosts not connecting to console. I had same problem with reports and none of configuration worked for me. When I fixed my "connection" issue, it fixed reports also. @ShaneDT didnt noticed connection problem or wrote it somewhere else...but for sure he have it. Link to comment Share on other sites More sharing options...
ShaneDT 13 Posted October 15, 2018 Author Share Posted October 15, 2018 17 minutes ago, MartinK said: Regarding reports are generated after reboot, could you verify configuration parameter "Invoke ASAP If Event Missed" of your triggers? In case this flag is enabled, it would explain why reports are sent after reboot. Yes I have that setting enabled, will disable and test it again. Pinni3, got a link to your post about connection problems? I'm not having any problems with hosts not connecting. Link to comment Share on other sites More sharing options...
Pinni3 21 Posted October 15, 2018 Share Posted October 15, 2018 (edited) 5 minutes ago, ShaneDT said: Yes I have that setting enabled, will disable and test it again. Pinni3, got a link to your post about connection problems? I'm not having any problems with hosts not connecting. Shane You have, You just didnt noticed it. When console dont send reports, check Your agent's status. You will notice that some of them doesn't work. If You have some test machine and it's working fine, reboot it then. You will notice errors in status.html https://forum.eset.com/topic/16883-solved-esmc-logs/ Information about reports is in different post but look after it in Your server...I was so frustrated Edited October 15, 2018 by Pinni3 Link to comment Share on other sites More sharing options...
ShaneDT 13 Posted October 16, 2018 Author Share Posted October 16, 2018 Pinni I had a look at the link you posted and the thread this was split from but can't see what the cause or solution is relating to my problem? I had a look at the server trace log and I do get the occasional error_code=INVALID_TOKEN, status=TOKEN_EXPIRED event recorded, but this doesn't seem to correlate with the reports not running and generally I'm not having any issues with agents not reporting in. You're a lot more experienced with these products than I am. Could you provide a clearer answer on what was the cause and the fix for the scheduled reports not running please? Link to comment Share on other sites More sharing options...
ShaneDT 13 Posted October 16, 2018 Author Share Posted October 16, 2018 (edited) 17 hours ago, MartinK said: Regarding reports are generated after reboot, could you verify configuration parameter "Invoke ASAP If Event Missed" of your triggers? In case this flag is enabled, it would explain why reports are sent after reboot. I've disabled this setting now on all the reports, and have duplicated one of the reports to run daily so will test this with a restart tomorrow if the daily report doesn't run. Also just a note from reading other posts, I am receiving notification emails fine. Just not receiving the scheduled reports. Edited October 16, 2018 by ShaneDT Link to comment Share on other sites More sharing options...
ESET Staff MartinK 378 Posted October 16, 2018 ESET Staff Share Posted October 16, 2018 3 hours ago, ShaneDT said: Just not receiving the scheduled reports. In case this is issue we have already resolved for upcoming release, it will be caused by time shift on machine where it is time-scheduled. We have seen this behavior especially on client machines where probability of time correction was higher... Regardless of that, I would recommend to contact ESET support. Enabled full trace logging from ESMC start to time when report was supposed to be executed will be required, so that state of the trigger can be traced from beginning to end ... Link to comment Share on other sites More sharing options...
Recommended Posts