kvngselassie 1 Posted November 9, 2020 Share Posted November 9, 2020 (edited) Hello @Marcos, I have been experiencing some issues with agents connection status, Some devices are able to connect with the ESMC Server but after some time they redirect host name to Local Host instead of IP address or host name of the ESMC server. Kindly assist. Thank You Edited November 9, 2020 by kvngselassie Link to comment Share on other sites More sharing options...
ESET Staff MartinK 376 Posted November 9, 2020 ESET Staff Share Posted November 9, 2020 Please double check that there is no configuration policy in your console that would do this. Also check that there is no remote deployment task, or any other deployment mechanisms actively used, as installation repair is another method how AGENT might be redirected. Link to comment Share on other sites More sharing options...
kvngselassie 1 Posted November 12, 2020 Author Share Posted November 12, 2020 On 11/9/2020 at 1:21 PM, MartinK said: Please double check that there is no configuration policy in your console that would do this. Also check that there is no remote deployment task, or any other deployment mechanisms actively used, as installation repair is another method how AGENT might be redirected. @MartinK There are no configuration policies in the console, all agent related policies are applied to separate groups... Also the only remote deployment task running is the agent upgrade and endpoint upgrade task... please not this also happens to devices with the latest version of the agent (7.2.1266). Link to comment Share on other sites More sharing options...
Miami 4 Posted November 12, 2020 Share Posted November 12, 2020 32 minutes ago, kvngselassie said: @MartinK There are no configuration policies in the console, all agent related policies are applied to separate groups... Also the only remote deployment task running is the agent upgrade and endpoint upgrade task... please not this also happens to devices with the latest version of the agent (7.2.1266). I am sure you have already double checked your policies, but this looks like Agent is being reconfigured after some time. Maybe after first connection to the server is the default policy overwritten by a forced one or the one which is closer to the computer in you structure. Is there only one server listed in Agent server list configuration? For testing purposes you could create a group where no policies would be applied. Add a computer into that group and manually apply all policies that are applied to these problematic computers. Link to comment Share on other sites More sharing options...
kvngselassie 1 Posted November 12, 2020 Author Share Posted November 12, 2020 11 minutes ago, Miami said: I am sure you have already double checked your policies, but this looks like Agent is being reconfigured after some time. Maybe after first connection to the server is the default policy overwritten by a forced one or the one which is closer to the computer in you structure. Is there only one server listed in Agent server list configuration? For testing purposes you could create a group where no policies would be applied. Add a computer into that group and manually apply all policies that are applied to these problematic computers. @Miami the issue is same policies are applied to devices in the console however some devices are experiencing this issue. they reset to localhost after some few minutes of connecting to the server. i raised the issue with our area support and they claim its because the database size is up to limit... but currently the total size of the DB is not up to 1GB. Link to comment Share on other sites More sharing options...
Miami 4 Posted November 12, 2020 Share Posted November 12, 2020 I understand your situation, but to me this really looks like some policy interfere with the default policy/configuration. What I would do is to check group membership of that problematic computer. Maybe it is a member of some dynamic group and gets special agent policy. If first connection is ok, it means something is doing a configuration change and if you have more Agent policies deployed it can happen that they interfere. I am guessing that info about last applied policies can be still seen in client details, same as its group membership. Related to agent connection issue, I experienced a, more servers in the server list configuration b, policy interference c, DNS configuration Link to comment Share on other sites More sharing options...
kvngselassie 1 Posted November 12, 2020 Author Share Posted November 12, 2020 7 minutes ago, Miami said: I understand your situation, but to me this really looks like some policy interfere with the default policy/configuration. What I would do is to check group membership of that problematic computer. Maybe it is a member of some dynamic group and gets special agent policy. If first connection is ok, it means something is doing a configuration change and if you have more Agent policies deployed it can happen that they interfere. I am guessing that info about last applied policies can be still seen in client details, same as its group membership. Related to agent connection issue, I experienced a, more servers in the server list configuration b, policy interference c, DNS configuration well noted @Miami, I will comb through the policies to see if there are any interferences there.... but the only policy currently applied is the agent policies with connection interval of 10secs... I will do my checks and get back to you... Link to comment Share on other sites More sharing options...
Recommended Posts