Jump to content
[[Template core/front/profile/profileHeader is throwing an error. This theme may be out of date. Run the support tool in the AdminCP to restore the default theme.]]

Flobberknock last won the day on September 19

Flobberknock had the most liked content!

Community Reputation

6 Neutral

My Information

  • Location
    UK
  • Agent Count
    > 6000 Agents

Recent Profile Visitors

The recent visitors block is disabled and is not being shown to other users.

  1. Hey guys I wanted to understand better how the “Distribute scripts over X” worked and was lucky enough to get an answer from the dev team, so here it is! First question: Distribute scripts over time. This is all handled by the database agent. What we do is: 1) Calculate the spread in seconds In your example 6000 agents over 6 hours converts to 21,600 seconds 21,600 / 6000 = 3.6 seconds. This is the script interval 2) Queue the scripts including appending the incrementing script interval to the schedule time 3) We then pull items from queued scripts and put them into running scripts based on the timestamp and the current time. HOWEVER, that does not mean they will run in an exact 3.6 second incremental order. One of the reasons is our max running scripts count. If other scripts are running and we are at our limit that can and will delay the scheduling of additional scripts. We also need to take into account how long these scheduled scripts take to complete. Because of this we may start out with a stagger of 3.6 seconds but it may grow into many minutes. Second Question: Online/Offline is not taken into consideration at time of scheduling, all offline agents will be staggered. Offline agents are not addressed until step 3, when we pull from pending to running. We will skip that agent if it is set to skip offline and it will be removed from the queued scripts unless it is repeating script.
  2. Thanks very much @DarrenWhite99, I've had a few ex client devices checking back in for months even after running the offboarding script so something is auto-deploying our agent. I tested it and it worked flawlessly. The 'blocking' technique worked by default and if you wanted to revert it I found (on a Win10 machine) that simply enabling inheritance on the registry key, and then removing the Deny entry on the LTsvc folder allows you to delete them so they can be installed again. Don't forget to remove the scheduled task as well otherwise it will all happen again after a reboot! Not sure why you'd do that after running the script but you never know!
  3. @timjee So are we, we're being patched next week so we'll be trying it out soon
  4. I believe he means to run the command Inventory-->Update Config (or do a Resend Everything) Although it most certainly would have happened by now anyway
  5. Usually requires a hard reboot. Certainly nothing to do with Automate CC as I have machines without the CC installed that have it. All of ours run Webroot Windows 10 1709 All running Automate Agent Opening Task Manager sets it off almost every time
  6. Hi All, Spent a lot of time working this one out but believe I have it, in case anyone else wants it. The below Internal Monitor has to be RAWSQL and it will return a list of all computers that have had over 500 'Failed Logins' (defined by the event ID's of the pre-built Internal Monitor) in a 1 day period Create Temporary Table IF NOT EXISTS Tcomp (INDEX (Computerid)) SELECT computerid FROM computers WHERE ComputerID NOT IN (Select ComputerID from AgentIgnore Where AgentID=4114); Select DISTINCT computers.computerid as TestValue,eventlogs.Message as IdentityField,computers.computerid,Computers.Name as computername,locations.locationid,locations.name as locationname,clients.Clientid,clients.name as clientname,agentcomputerdata.NoAlerts,AgentComputerData.UpTimeStart,AgentComputerData.UpTimeEnd FROM ((Computers LEFT JOIN Locations ON Locations.LocationID=Computers.Locationid) LEFT JOIN Clients ON Clients.ClientID=Computers.clientid) JOIN AgentComputerData on Computers.ComputerID=AgentComputerData.ComputerID INNER JOIN eventlogs ON Computers.ComputerID = eventlogs.ComputerID WHERE eventlogs.EventID IN (529, 644, 681, 4625) and eventlogs.timegen > DATE_SUB(CURRENT_DATE(), INTERVAL 1 DAY) GROUP BY Computers.ComputerID, Computers.Name, eventlogs.EventID HAVING COUNT(EventID) > 500 AND Computers.ComputerID IN (Select ComputerID From Tcomp) I hope this saves someone many hours! Cheers, James
  7. Hi All, We're in the process of migrating our 14,000 endpoints from GFI/LogicNow/SolarWinds RMM over to Automate and wanted to shout out to all of you who are currently running the product of anything you think we should be aware of from a nice blank install of Automate? I'm curious to hear any "if I could go back" stories or if you would do anything differently based on the knowledge you have now since installing the product? We are in very early implementation with only our internal devices on the platform and are working with our Automate consultant on a few things (we've just turned on Ignite and damn that thing is noisy, especially for workstations). Interested in any thoughts, stories and ideas you guys have, we're very new to the product so apologies if I come across a bit stupid at times because of that!
×
×
  • Create New...