[Xymon] BBWIN hidden services

[David Baldwin]

On 13/03/13 8:06 AM, Simmons Clint wrote:
>
> We recently upgraded our Symantec AV server, and started to cut the
> clients over from SEP client 11.x to SEP client 12.x. In doing so the
> service name changed after a reboot from “Symantec Antivirus” to
> “SepMasterClient”
>
>  
>
> The BBWin agent on either 12.x or 13.x does not send the new service
> name over to the Xymon server properly and therefore is unable to
> match the service name.
>
>  
>
> We are running all clients in a central mode.
>
>  
>
> This also does not appear to be a 32bit vs 64bit issue as we have
> noticed the issue persists on the 32bit machines.
>
>  
>
> Has anyone else had this issue with the BBWin agent not sending all
> windows services properly?
>
>  
>
Yes - the "MsMpSvc" (Microsoft Antimalware Service) - part of SCEP -
does not appear in the list of services BBWin reports.

I worked around this by checking for 1 and only 1 running instance on
MsMpEng.exe in PROC in analysis.cfg

        PROC MsMpEng.exe 1 1

This is also a way to check that a service that may not be installed is
not running (change "1 1" to "0 0")

David.

-- 
David Baldwin - Senior Systems Administrator (Datacentres + Networks)
Information and Communication Technology Services
Australian Sports Commission          http://ausport.gov.au
Tel 02 62147830 Fax 02 62141830       PO Box 176 Belconnen ACT 2616
david.baldwin at ausport.gov.au          Leverrier Street Bruce ACT 2617


-------------------------------------------------------------------------------------
Keep up to date with what's happening in Australian sport visit http://www.ausport.gov.au

This message is intended for the addressee named and may contain confidential and privileged information. If you are not the intended recipient please note that any form of distribution, copying or use of this communication or the information in it is strictly prohibited and may be unlawful. If you receive this message in error, please delete it and notify the sender.
-------------------------------------------------------------------------------------
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.xymon.com/pipermail/xymon/attachments/20130313/473b2ce9/attachment.html>