We have a number of Macs running v14.x connected to a 14.x SEPM server. The virus definitions on these macs are continually out of date on SEPM. For instance, even though a handful show having last communicated with SEPM today the 11th, all of their virus definitions are listed as the 5th or 6th. Often time most of them are offline. For instance 5 of them are virutal machines running on a Mac ESXi host, which means they are always on, yet even after reboot they often show as being offline, but having had talked to the server today, so I know the components are running. Further more even though I have a scheduled scan set for every night at 1 am and to cancel if its still running by 6 am, the systems will have times that the last time they completed a scan as long a week or more ago. Even some of the virtual machines report this, or no scans completed at all, when they have nothing on them except the os and a few apps, and a small disk size(80gb).
However, then I log into the console of any mac the menu bar application shows the state as "connected", even when the server states it is offline. The client side applciation usually lists the definitions as being up to date(today or yesterday), yet the SEPM console lists them being vastly out of date. It appears that after logging in to the console of a mac, the SEPM updates with new information, sometimes.
This leads me to believe that SEPM getting properly updated information is entirely dependant on a user being logged into the client. I read this was the case in 12.1.x. Is this correct in version 14? I hope not as that's the worst client/server AV application design I've ever seen. Both the LiveUpdate and SymDaemon processes run full time as root. They should not need a user logged in to perform any communications with the server. I have tried to ssh into clients to see if I could determine the definition date from the command line, thus not causing the gui menu bar application to open, and have no found a way to check connection status or AV def version information from the terminal. From the only real mac document I've found on symtantec's site, the Mac FAQ, it doesn't appear there is a way to check defintion versions or communication status except using the gui app, which makes troubleshooting in the scenerio nearly impossible. Not to mention if I could check that information from the command line I'd script reporting back to our mac management software for compliance and forego the appearingly faulty SEPM<->SEP relationship for reporting. But alas it seems there are no commandline options for sepm 14 except to restart the daemon and run lutool.
Does anyone have any reliable information from symantec on if this behavior is expected, or any suggetsions on how to get the SEPM console to reflect the client status without having users loging in just to get that information updated? Is there a way to pull definition date, connection status, last scan date from the command line?
SEPM not having accurate information makes if very difficult to report compliance to our overlords. I'm not going to chase users around every week begging them to log into their systems so it security can get the compliance it needs, and IT security isn't going to continually accept submitting garbage reports to their higher-ups.
We have a number of Macs running v14.x connected to a 14.x SEPM server. The virus definitions on these macs are continually out of date on SEPM. For instance, even though a handful show having last communicated with SEPM today the 11th, all of their virus definitions are listed as the 5th or 6th. Often time most of them are offline. For instance 5 of them are virtual machines running on a Mac ESXi host, which means they are always on, yet even after reboot they often show as being offline, but having had talked to the server today, so I know the components are running. Furthermore even though I have a scheduled scan set for every night at 1 am and to cancel if it’s still running by 6 am, and two scans to run, Monday and Thursday, during the day until they complete, yet the systems will have times that the last time they completed a scan was a week ago or more. Even some of the virtual machines report this, or no scans completed at all, when they have nothing on them except the os and a few apps, a small disk size(80gb), and no users logged in to interrupt an scanning.
However, then I log into the console of any mac the menu bar application shows the state as "connected", even when the server states it is offline. The client side application usually lists the definitions as being up to date(today or yesterday), yet the SEPM console lists them being vastly out of date. It appears that after logging in to the console of a mac, the SEPM updates with new information, sometimes.
This leads me to believe that SEPM getting properly updated information is entirely dependent on a user being logged into the client. I read this was the case in 12.1.x. Is this correct in version 14? I hope not as that's the worst client/server AV application design I've ever seen. Both the LiveUpdate and SymDaemon processes run full time as root. They should not need a user logged in to perform any communications with the server. I have tried to ssh into clients to see if I could determine the definition date from the command line, thus not causing the gui menu bar application to open, and have no found a way to check connection status or AV def version information from the terminal. From the only real mac document I've found on symtantec's site, the Mac FAQ, it doesn't appear there is a way to check definition versions or communication status except using the gui app, which makes troubleshooting in the scenario nearly impossible. Not to mention if I could check that information from the command line I'd script reporting back to our mac management software for compliance and forego the appealingly faulty SEPM<->SEP relationship for reporting. But alas it seems there are no command line options for sepm 14 except to restart the daemon and run lutool.
Does anyone have any reliable information from symantec on if this behavior is expected, or any suggestions on how to get the SEPM console to reflect the client status without having users logging in just to get that information updated? Is there a way to pull definition date, connection status, last scan date from the command line?
SEPM not having accurate information makes it very difficult to report compliance to our overlords. I'm not going to chase users around every week begging them to log into their systems so it security can get the compliance it needs, and IT security isn't going to continually accept submitting garbage reports to their higher-ups.
Thank you for any feedback,
Paul