Client Management Suite

 View Only
  • 1.  Remote malware scanning via agent - how to ingest log data.

    Posted Sep 23, 2015 04:44 PM

    Hello,

    I've managed to develop a method for scanning for malware on endpoints via stand-alone scanning tools deployed via software delivery. It is then run as a command-line. It self-updates and is silent to the end user and it even works over CEM.

    The result is dumped as a plain text file in the same directory as the scanning executable. How can I get the results of what is in that log file and put it in an easy to access place for locked down SMP console users? Just need some ideas to tinker with...

    Thanks.



  • 2.  RE: Remote malware scanning via agent - how to ingest log data.

    Broadcom Employee
    Posted Sep 24, 2015 04:45 AM

    Hi Todd,

    Have considered to use a "Run Script" task with enabled "Save script output with task status"?

    You can use "Run Script" client task via powershell or cmd line to parse appropriate file(s) on managed endpoints and get data into "Symantec_CMDB" database, where all this saved output data will be available in "TaskOutputPropertyValue" sql table -

    "tmSelectTaskOutputProperties" stored procedure can provide output from executed task for specified TaskInstanceGuid to see delivered output data for client PC, where task is executed

    As simple example:

    ScanViruses2.jpg

     

    Or you can create Client Job with this task and set there Task Condition:

    For example if client task executes on client PC and get data Viruses=0, then set this task instance to be successfully completed and if Viruses=1, then fail it == Otherwise you will see common status, where task failed, then their scanned results file contains Viruses=1, etc.

    Thanks,

    IP.



  • 3.  RE: Remote malware scanning via agent - how to ingest log data.

    Posted Sep 24, 2015 09:50 AM

    Hi Igor!

    I tried that as regular command script and it was only sending back the output of the command line itself, but not the content of the created text file. So now I will try with Powershell and see if that works. Thanks!

    Todd



  • 4.  RE: Remote malware scanning via agent - how to ingest log data.
    Best Answer

    Posted Sep 24, 2015 12:02 PM

    Well, the solution was easier than I thought. Instead of forcing the application to dump to a specific named log file I just let it write its own by default and then it returned results. :)