This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos enterprise console managed clients communication issues

Hello everyone.

 

I have a small issue with my SEC managed clients. Issue is my clients doesn't report all the data to the SEC. For example clients status shows on the SEC (online or offline) Also it shows that "same as policy" on the SEC. Things that doesn't show on the SEC is like DLP evens web events device control events etc. ports are also opened (8192 and 8194). all the communication is going through a VPN and a hardware firewall. client network report also doesn't show any issues as well.

 

hope this clarifies my problem.

 

Thanks in advance.



This thread was automatically locked due to age.
Parents
  • Hello Asankag,

    online or offline
    or rather Connected and Disconnected. The Connected status is shown when the endpoint's RMS establishes a connection with the management server. The status is changed to Disconnected when the connection is orderly shut down from the endpoint's side. This is the case when the Sophos Message Router service is stopped. The status remains Connected when the service crashes or the physical path is disrupted (e.g. network cable unplugged).
    doesn't show events
    An endpoint can be Connected but fail (for whatever reason) to send its status or Alerts and Events. If it does send its status it should send Events as well. Same as policy is only significant if it recently showed some other status. Up to date would be be the more or less conclusive (as you can expect new updates every few hours) value under the Status tab, and the Last message time under the Computer Details tab is updated when the endpoint actually sends one of the mentioned messages.

    How did you find out that they don't report all the data, is it indeed not all or no data at all?

    Christian

  • Hi Cristian.

     

    Thanks for the reply. We have deployed a DLP policy to these client pc's and its working as expected. documents which is transferred to external devices are getting blocked and its getting logged on the client DLP log as well. But on the SEC under DLP event nothing shows. what is the best way to confirm SEC and client communication works fine except for telnet ports (Because I have already done it. yet, I suspect that some thing is wrong with the client-server communication). will I able to check it with "wireshark" ?

     

    Regards and many thanks.

  • Hello Asankag ,

    under DLP event
    you mean EventsData Control Events ..., right? And it's empty regardless of the Search period you select? Also when you select an endpoint and View Computer Details there are no entries  under Latest data control events? Your policy is set to unconditionally block transfers?

    Christian

  • Dear Cristian,

     

    Thanks for the reply and Yes, you are 100% correct. No event data at all except for in DLP log file on the client PC. This is how my policy is set. Check the documents whether they contain word "PASSWORD" and if they are transferred to external devices then it should be blocked. The policy is working fine and its working as expected. (except it reporting to the console :) )

     

    Regards

Reply
  • Dear Cristian,

     

    Thanks for the reply and Yes, you are 100% correct. No event data at all except for in DLP log file on the client PC. This is how my policy is set. Check the documents whether they contain word "PASSWORD" and if they are transferred to external devices then it should be blocked. The policy is working fine and its working as expected. (except it reporting to the console :) )

     

    Regards

Children
  • Hello Asankag,

    apart from being logged in the Data Control log the event should cause the following:

    • an entry like SAV event observer received an event: [...] description="A "block transfer" action was taken. [...] appears in the Agent log (%ProgramData%\Sophos\Remote Management System\3\Agent\Logs\)
    • in the Router log (%ProgramData%\Sophos\Remote Management System\3\Router\Logs\) a corresponding message is logged
      Routing to parent: id=00112233, origin=Router$endpoint:12345.Agent, dest=EM, type=EM-EntityEvent
      Sent message (id=00112233) to Router$SEC-server

    If the Sent message does not appear then the Router can't send the message to the management server for whatever reason. In that case there should be one or more .msg files in the ...\Router\Envelopes\ folder. The Router log should show communication issues, as the relevant entries could be "farther up" I'd normally restart the Message Router service (assuming the problem is "hard" this will result in the same errors to be logged) - but this might not be feasible in your situation (VPN).

    Christian