Symantec Case 320-239-094 (issue in Searching the clients in SEPM Console after upgrading the SEPM Server from MR4MP2 to RU5
Dear Team,
Greetings!!!
We are facing the issue in Searching the clients in SEPM Console after upgrading the SEPM Server from MR4MP2 to RU5. When we select the search client option from SEPM console and search for a particular IP Range, the result displayed are not proper. For searching an IP range we are using >= and <= Comparison Operators under Search Criteria after selecting IP Address in Search Field.Kindly find the attached screenshots for more details. I had logged the case with Symantec Support for this issue and explained the issue to Ms.Sharmila (from Symantec Support). She informed to submit my request here to get the fast action for this case. Kindly find the case details below :-
========================================================================================
|
Summary : |
|
 |
|
|
issue in Searching the clients in SEPM Console after upgrading the SEPM Server from MR4MP2 to RU5 |
|
|
|
Detail : |
|
|
|
Case: 320-239-094 Environment: =============================================================== Issue Description: Issue in Searching the clients in SEPM Console after upgrading the SEPM Server from MR4 MP2 to RU5 =============================================================== Observation: # Tried to check the version of SEPM Troubleshooting: # When searched with search comparison (Search client) Reference: 2009112100361848 |
||
SHARMILA=======================================================================================================
I would request for a quick solution to this issue as we use this search option to move the clients from one group to another. We have more than 80,000 system in our network and this search option helps us to move a partcular IP Range from one group to another.
Wrong Query result have following impacts on us :-
1. Cannot move the entire IP Range from a partcular group to a specific group.
2. Movement of clients takes longer time as now we have to search for a single IP address instead of IP Range.
3. There is increase in Network Bandwidth utilization as all the machines gets registered in a default group and according to their IP Range we move them to a partcular group having the GUP of that Range.
I hope you will consider our request and expidate the things for reaching a solution to this issue.
With Regards,
Deepak Pandita
Comments
Me Too.
I'm having exactly the same issue. Case 281-823-815 (Search client function is returning incorrect information....)
I'm also puzzled by this. I
I'm also puzzled by this. I set my search terms and all the returned clients have IP's outside my defined range.
e.g.
ip >= 172.20.18.0
ip <= 172.20.18.254
results
192.168.0.1
172.22.234.9
The only thing I can figure is that its dealing with the 172.x numbers as absolute numbers not dotted decimal expressions. But even that doesn't line up with what I'm seeing.
Has anyone gotten this issue
Has anyone gotten this issue resolved? I have 11.0.5 and have the issue.
_________________________________________________________________
Please remember to mark the thread 'SOLVED' with the answer that most helped you by choosing 'Mark As Solution' on the applicable answer
in issue this way
I vaguely recall that I had this issue before, I am going to look through my old submittals. Doing the search your way does still give me the issue and I am 11.0.5 also.
I went and searched my
I went and searched my entries and found there wasn't an answer:
https://www-secure.symantec.com/connect/idea/search-clients-ip-wildcards-clients-tab-clients-group#comment-3630721
Deepak/MSchotz Did either of
Deepak/MSchotz
Did either of you get your cases solved and closed? I am in the same situation trying to find a resolution to this. Anyone else have any input?
_________________________________________________________________
Please remember to mark the thread 'SOLVED' with the answer that most helped you by choosing 'Mark As Solution' on the applicable answer
Negative. Still having the
Negative. Still having the same issue.
Me too
I get this also.
Blaine Baker
Information Security Administrator
Try to run a search from a lower level, not from My Company
Does it work if you run a search from a lower organizational level, so not from "My Company", but from a (sub) group?
And what are the results if you run the same search in e.g. MSSQL Administrator using and SQL query?
I am subscribed to this post, so please let me know what you find.
SQL workaround does appear to work
I tried searching from a desktops subgroup with these criteria:
IP Address > 10.129.120.0
IP Address < 10.129.120.255
The first machine in the list has an IP in the 10.136.0.0/16 range.
In SQL Management Studio, I looked at the sem5 database and found the table dbo.SEM_COMPUTER. The IP_ADDR1 table looked strange and it took me a minute to realize that the addresses were being represented in base 10. Google is my friend, and an IP is converted to base 10 this way:
octet1 x (256)^3 + octest2 x (256)^2 + octet3 x (256)^1 + octet4 = ip in base10
So, in this case...
10(256)^3 + 129(256)^2 + 120(256)^1+0 = 176257024
10(256)^3 + 129(256)^2 + 120(256)^1+254 = 176257278
This was my completed SQL query against sem5:
select COMPUTER_NAME, IP_ADDR1 from sem_computer
where IP_ADDR1 BETWEEN 176257024 AND 176257278
If you wanted more info you could do select * instead. I got a list that looks much more like what I'm expecting. I haven't gone through
them all for IPs but this method appears to do the job. I don't know that I would call this a resolution to the issue, since the SEPM GUI should be doing this, but this is likely a valid workaround.
Blaine Baker
Information Security Administrator
Public document available
Please refer to the following document:
'When searching for Clients by Name, IP address or sub-net, the results returned are incorrect'
http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2010042110432848
Symantec are aware of the issue and should resolve it in an upcoming maintenance patch for Ru6.
Would you like to reply?
Login or Register to post your comment.