Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.
Endpoint Management Community Blog

Quick query to find agents that are not working properly

Created: 22 Jan 2013 • Updated: 22 Jan 2013 • 1 comment
Ludovic Ferre's picture
+3 3 Votes
Login to vote

I just finished a remote session with a customer that found a computer from the database that is not sending data back.

I had received the log files yesterday and the log viewer was all red and blue. Upon inspection it was clear that the agent COM components are not working (not registered or unregistered), so no basic inventory, client session management or sub-agents could perform their normal tasks.

Still the agent was getting it's policy file from the server, but not being able to do anything with the given policy (given its state).

We checked the computer Windows logs and found nothing interesting in there, so we crafted a SQL query to detect other computers with similar issues:

       i.Name, MAX(_eventtime) 'Last config request',
       MAX(s.ModifiedDate) 'Last Basic Inventory',
       MAX(s.createdDate) 'First inventory',
       DATEDIFF(d, max(s.modifiedDate),
       MAX(c._eventtime)) 'Not working',
       DATEDIFF(d, max(s.createddate),
       MAX(s.ModifiedDate)) 'Working'
  from ResourceUpdateSummary s
  join Evt_NS_Client_Config_Request c
    on s.ResourceGuid = c.ResourceGuid
  join Inv_AeX_AC_Identification i
    on s.ResourceGuid = i._ResourceGuid
 where InventoryClassGuid = '9E6F402A-6A45-4CBA-9299-C2323F73A506' -- Client Agent dataclass guid
 group by s.ResourceGuid, i.Name	
having DATEDIFF(d, max(s.modifiedDate), max(c._eventtime)) > 10
 order by MAX(_eventtime) Desc

There isn't anything magical there, but it was quite interesting to get a view of computers and the number of days they were working and not working.

Comments 1 CommentJump to latest comment

Saur's picture

Brilliant, this is very helful.

Login to vote