This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Delay in Console Showing Client Status

Hi All,

I have a general query in regard to the length of time it takes for the status of a client to be displayed in Enterprise Console. We are running SEC (5.2.1 R2) on a Window Server 2008 R2 Enterprise (64-bit).

When deploying Sophos Endpoint Security & Control (10.3.1.498.1) to a client PC, it sometimes take upwards of 20-30 minutes after the installation has completed for the client status to appear (i.e. restart required etc.) in Enterprise Console. As I recall this wasn't the case in previous versions of Enterprise Console we ran.

Is there a set polling interval that SEC uses when querying the status of protected clients and is this configurable?

Any input would be much appreciated, many thanks,

JP

:49852


This thread was automatically locked due to age.
Parents
  • Hi Christian,

    Thank you for your prompt reply.

    I observed the time taken for deployment to the client by being connected to the client (via RDP) and visually checking the installation status. Once Endpoint Security had been successfully deployed I switched back to the Enterprise Console Server to observer how long it took for the client to reappear as managed and connected (albeit with a restart warning). This is where I came up with the 20-30 minute timeframe.

    I appreciate that our method of deployment (using Protect) may not be the optimum method of installing SAV on to client PCs. Our network isn't overly large (approx 600 clients), all with static IP addresses. When a new client PC is rolled out, we discover by IP range and subsequently protect the PC.

    I should add that our Enterprise Console is running on a virtual server. It has two NICs, one for the production network and the second for backup. The backup NIC is on a non-routable subnet (NOT in DNS) and is used by DPM (our backup solution). I redeployed SAV to a test PC whilst running Network Monitor and observed the test PC trying to connect to the backup NIC over port 8194 (I imagine this is RMS reporting the client status back to the console server). It would appear that during deployment of SAV to the client, the backup IP address of the console server is being supplied to the client. The client subsequently tries to establish contact with the console server (on port 8194) on the backup IP address. I'm wondering if this could contribute to the delay in clients appearing in the console.

    I will disable the backup interface on the console server, remove SAV from the test PC and re-install from the console to see if the client reports it status back quicker.

    Apologies for the long-winded reply.

    JP

    :49858

    2 x SG450 (Version 9.714-4)

    HA = Active-Passive

Reply
  • Hi Christian,

    Thank you for your prompt reply.

    I observed the time taken for deployment to the client by being connected to the client (via RDP) and visually checking the installation status. Once Endpoint Security had been successfully deployed I switched back to the Enterprise Console Server to observer how long it took for the client to reappear as managed and connected (albeit with a restart warning). This is where I came up with the 20-30 minute timeframe.

    I appreciate that our method of deployment (using Protect) may not be the optimum method of installing SAV on to client PCs. Our network isn't overly large (approx 600 clients), all with static IP addresses. When a new client PC is rolled out, we discover by IP range and subsequently protect the PC.

    I should add that our Enterprise Console is running on a virtual server. It has two NICs, one for the production network and the second for backup. The backup NIC is on a non-routable subnet (NOT in DNS) and is used by DPM (our backup solution). I redeployed SAV to a test PC whilst running Network Monitor and observed the test PC trying to connect to the backup NIC over port 8194 (I imagine this is RMS reporting the client status back to the console server). It would appear that during deployment of SAV to the client, the backup IP address of the console server is being supplied to the client. The client subsequently tries to establish contact with the console server (on port 8194) on the backup IP address. I'm wondering if this could contribute to the delay in clients appearing in the console.

    I will disable the backup interface on the console server, remove SAV from the test PC and re-install from the console to see if the client reports it status back quicker.

    Apologies for the long-winded reply.

    JP

    :49858

    2 x SG450 (Version 9.714-4)

    HA = Active-Passive

Children
No Data