This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Howto get rid of old entries in Endpoint protection

As you can see my endpoint protection is shown s active with 3 endpoints.

But my endpoint protection is turned off.

The 3 endpoint do not exist since years, but I find no way to delete them.

Searching the forum didn't help. When I look for help:

This screen tells me I can't change the settings anymore.

Can I do anything on the cli?



This thread was automatically locked due to age.
  • Hallo,

    What do you get from doing the following as root at the command line?

         cc get epp endpoints

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • Thanks Bob.

    What I get is:

    [
              'REF_EppEndWkx60s',
              'REF_EppEndX5pro',
              'REF_EppEndIna'
            ]

    I know these Laptops, but they do not longer exist.

    cu
    Walter

  • Walter, you will want to get Sophos Support to approve of you doing the following as I'm not certain there isn't something else you should do:

       cc
       epp
       endpoints@
       =[]

    You should get:

       result: 1

    Finally:

       exit

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • Thanks Bob,

    as this is only a home licence, support won't help me.

    I tried your solution and got the right result.
    Now after a reboot the command: cc get epp endpoints shows [] and no more endpoints are shown with

    cc
       epp
       endpoints@

    But on the webadmin screen nothing changed:

    Endpoint Protection is active, Sophos LiveConnect is enabled, 3 endpoints, 0 thread alerts, 0 out-of-date alerts

    cu
    Walter

  • Interesting...  What do you see with:

       cc get epp status

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • {
              'av' => 1,
              'broker' => 1,
              'dc' => 1,
              'epp' => 1,
              'wc' => 0
            }

    cu
    Walter

  • Ahhhh, just looked more closely at the first image in your opening post.  What happens if you disable Sophos Live Connect in 'Endpoint Protection >> Web Control'?

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • Bob I don't understand what I shall disable.

    As you can see in the first post 'Endpoint Web Control' is disabled and there is no more switch on that screen.

    Sophos LiveConnect is mentioned in the description of Endpoint Web Control but no possibillity to turn on or off.

    cu
    Walter

  • If enabling/disabling doesn't fix it, Walter, I think it's time to get Sophos Support involved.

    Cheers - Bob.

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • Bob,
    thank you for trying to help me with all your experience.

    As said, it is a home licence so support won't help me.

    But anyway it is not essential
    It only shows a false information on the dashboard and writes a few bytes to the log every three hours that I can't interpret.

    2022:04:08-01:00:44 fw epsecd[6150]: I id="424200" severity="info" sys="System" sub="epsecd" name="Parent proxy has changed re-connecting"
    2022:04:08-01:00:44 fw epsecd[6150]: I id="4223" severity="info" sys="System" sub="epsecd" name="Closing socket to Sophos LiveConnect"
    2022:04:08-01:00:45 fw epsecd[6150]: I id="4232" severity="info" sys="System" sub="epsecd" name="Not syncing web policy resources as web control is disabled"
    2022:04:08-01:00:48 fw epsecd[6150]: I id="4231" severity="info" sys="System" sub="epsecd" name="Syncing SWC with web control global status "
    2022:04:08-04:00:39 fw epsecd[6150]: I id="424200" severity="info" sys="System" sub="epsecd" name="Parent proxy has changed re-connecting"
    2022:04:08-04:00:39 fw epsecd[6150]: I id="4223" severity="info" sys="System" sub="epsecd" name="Closing socket to Sophos LiveConnect"
    2022:04:08-04:00:40 fw epsecd[6150]: I id="4232" severity="info" sys="System" sub="epsecd" name="Not syncing web policy resources as web control is disabled"
    2022:04:08-04:00:43 fw epsecd[6150]: I id="4231" severity="info" sys="System" sub="epsecd" name="Syncing SWC with web control global status "
    2022:04:08-07:00:47 fw epsecd[6150]: I id="424200" severity="info" sys="System" sub="epsecd" name="Parent proxy has changed re-connecting"
    2022:04:08-07:00:47 fw epsecd[6150]: I id="4223" severity="info" sys="System" sub="epsecd" name="Closing socket to Sophos LiveConnect"
    2022:04:08-07:00:48 fw epsecd[6150]: I id="4232" severity="info" sys="System" sub="epsecd" name="Not syncing web policy resources as web control is disabled"
    2022:04:08-07:00:51 fw epsecd[6150]: I id="4231" severity="info" sys="System" sub="epsecd" name="Syncing SWC with web control global status "

    cu
    Walter