Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Anyone using NPM or APM to monitor nodes and their anti-virus updates?

I was asked if Solarwinds can be used to report on those nodes which do not get their updates successfully for anti-virus software.

When they (nodes) are updated it does insert an event into the local Application Event Log, so I thought of using the Windows Log Forwarder perhaps, but we're talking about several hundred nodes needing the Log Forwarder installed on them.

I'm just curious if anyone else has other ideas or solutions in place.

Thanks.

Find more posts tagged with

Accepted answers

All comments

kspencer

Hey lchance,

I was asked the same thing by my CIO and Director. We use McAfee and the best thing I could do for them was monitor the EPO Agent process on each server. However, just because the process is running doesn't mean it's getting the latest dats.

As for loading the log forwarder I have the same problem as you (numbers). Also 75% of the one's I have tried so far need .net and that would break applications on specific servers.

I would also appreciate any ideas as well on this one.

Thanks,

Katrina

ecklerwr1

I'm not sure what antivirus software you are using but if it's symantec here's a good article cisco show how to get symantec to send traps to MARS. This would work exactly the same to send traps to NPM.

http://www.cisco.com/en/US/docs/security/security_management/cs-mars/6.0/device/configuration/guide/chSymantecAv.html#wp236102

lchance

That's good info for the 'you got a virus' event but we're mostly looking for some type of report to identify those systems in the corporation where the anti-virus updates got missed - that is - the .DAT files were not updated...mostly laptops in our case.

We do use Symantec here, so I'll be offering the SNMP TRAP to the group. Thanks for that great info.

ecklerwr1

I was thinking there might be a way to use this trap and possibly report on any nodes that haven't had one within a certain time frame:

Alert: Virus Definition File Update

•Alert: <Alert Name >

•Computer: <Computer Name >

•Date: <Date >

•Time: <Time >

•Description: <Description >

•Severity: <Severity >

•Source: <Source >

Just a beginning idea though I haven't followed through with this type of report yet but once again lchance you've given me another good idea of something to Implement