ERA Client Reporting

[segFault 2]

I've been running into random issues after upgrading to 5.1.38 (from 5.1.34), where some of my clients (EES 5.0.2225.0) don't report back to my ERA Server with current information. For example, my ERA console reports that A,B,C,D don't have current virus definition updates, even though they reported back to the server within an acceptable timeframe. If I manually check the definition updates on those clients, they're updated to the latest and greatest, per the GUI. 

 

I've restarted those affected, and beyond the initial connection to the ERA Server, they don't report back again.

 

Thx,

 

segFault. 

Edited March 8, 2014 by segFault

[PatrickL 21]

segFault,

 

   Can you advise me if these clients are new installations that you are referencing in your example? If so, can you export the configuration for your isntallation as well as the configuration for your default policy in Remote Administrator and send them to me via a direct message?

 

If these are not fresh installs, then please send me the scenario that these machines are in as well as just the policy configuration (steps also below).

 

I am wondering if the clients are installing with a 0 interval and reporting before the update happens and then there is a typo in the policy (or a null value marked) that has the client not reporting in anymore after the initial checkin. Please send me a copy of the configuration from your install package as well as the policy from your Remote Adminstrator for me to analyze.

 

Steps for package configuration:

Open the remote administrator and go to the remote install tab and click Actions>Manage package. Click edit on the left side to edit the policy and click ok on the version confirmation. When the configuration editor opens, click File>Export marked to... and save it somewhere you can access and name it 'install.xml'. 

 

Steps for policy configuration:

Open remote administrator and click on Tools>Policy manager. In the dialogue that opens, there will be a policy with a black box (by default it is called Server Policy). Please double click on that policy and in the configuration editor that opens, click File>Export marked to... and save it somewhere you can access and name it 'policy.xml'.

 

Please send those to me via a direct message so I can review them and assist.

 

Patrick

[segFault 2]

All of the clients are new installs. Installing config is default (haven't made any changes) - I'll be shooting you a PM by EoD.

 

segFault

[PatrickL 21]

segFault,

 

  Thank you for the policies. I need a little more information from you to get a thorough udnerstanding of the process that these new installations are going through. One question and one file request (reply to me with the file via PM, please)

 

Question - in your policy tree you sent me, I need to know which is the default policy for new clients. Its easiest to tell by looking at the policy list and seeing which has a black box to the left of the policy name. Please look at your policy tree and advise me which is the default policy.

 

The file request is a copy of the XML from a client machine that is not reporting. You upgrade the client with the install policy you sent and it reports to the tree you sent then it falls off. I need you to grab a machine, upgrade it, confirm its not reporting and then remote to that machine and export the XML from it and send to me directly via PM, please.

 

With these ttwo pieces of information, I hope to be able to confirm my suspicions.

 

Patrick

[Marcos 5,070]

Please navigate to Server options -> General and compare the virus signature database version shown in the pane with that on the clients that appear as outdated in the ERA console. Do they match or they are different?

[segFault 2]

Marcos - Different. Server options shows latest downloaded signature. Affected clients show outdated signature version via ERA console. Affected clients show that they have the updated signature in the local GUI (ESS .2225.0).

 

Patrick - Info to follow.

 

Appreciate the help to diagnose!

 

segFault

[Marcos 5,070]

Please post some screen shots to illustrate the issue. It is not clear what signature database is reported in Server options -> General and on problematic clients and which one is newer as you said they were different.

[segFault 2]

Latest is shown under Server Options --> General (e.g. if latest signature db downloaded is 1000, it shows 1000), affected clients show a prior release in the ERA Console (e.g. signature database 950), the GUI (not ERA console, but user's computer) shows the latest signature db is installed). Hopefully this makes sense. Otherwise, when I get a few minutes I'll provide screenshots as requested.

[segFault 2]

Screenshots as requested.

 

Regards,

 

segFault