Collection Alerting for Endpoint Protection and Client Status

both for the Client Status alerts and for the Endpoint Protection alerts I have set these up on one collection each,
the thing is if you go to the Client Status node under monitoring, by default the collection 'All desktop and server clients' is selected, while this one doesn't even have the alert configured
same goes for endpoint protection, where by default the collection 'All client Systems' is selected ...
what is the purpose of configuring a specific collection for the alerting, if you have to select this every time you look at the monitoring?
try to explain that to customers..

The purpose of configuring alerts for different Collections is that you can have e-mails send to different Groups. When you create subscriptions you can select the different alerts and configure them to mailed to different Groups.
Kent Agerlund | My blogs: blog.coretech.dk/kea and
SCUG.dk/ | Twitter:
@Agerlund | Linkedin: Kent Agerlund |
Mastering ConfigMgr 2012 The Fundamentals

Similar Messages

Configuring SMTP account for Endpoint protection alerts

Hi all
I am using SCCM 2012 R2 Endpoint protection. I want to configure email alerts for Endpoint protection. I have mail server in Windows 2008 R2 server in a WORKGROUP. Since mail server is not in domain , how can i configure SMTP server setting. What account
i need to use for SMTP?

You can get advice from others on the forum Ashok but ultimately you are the only one that will be able to figure this out. You need to look at your mail server (or talk to the person that manages it) and see how it is configured to allow email relay from
the firewall, for example. It could be that the mail server is configured with a rule to allow relays anonymously from that specific IP address.
You then need to configure the email server to allow the requests from the ConfigMgr server in exactly the same way. It might be as simple as adding the IP address to the above rule. You will NOT need to configure an Endpoint Protection SMTP Server Connection
Account. As Joyce says this is only required if the mail server REQUIRES authenticated access (but you can configure the rule so that it doesn't).
"they just use SMTP server and a email address for authentication"
This isn't the case Ashok. This is not authentication. The email address is just a label so that you can see where the alert is coming from.
I hope this is all clear. This isn't a ConfigMgr issue as such. It's email relaying so is specific to the email product you use.
Gerry Hampson | Blog:
www.gerryhampsoncm.blogspot.ie | LinkedIn:
Gerry Hampson | Twitter:
@gerryhampson

Can i use same Server for server side and client??

Hi,
i m developing webservices in java and using two different server for server side and client.
e.g. i m using one tomcat server on a machine to run webservice and again using one more tomcat server on client side at different machine.
and hence it need two tomcat server.
But i want only one server to run webservice and client.
So please help me out...
Thanks

Hi,
It is always recommended to maintain different servers
REgards,
Ravi.

Exit CL_HRASR00_POBJ_WF_EXIT triggered exeception for event STATE_CHG and (target) status READY- ERROR EVENT_RAISED - Error updating the process object

Hi All
I have set up a simple custom HCM process and Form regarding Infotype TO CREATE AND CHANGE POSITION. I have checked the process and form consistency and it seems fine. Now when I run the process from HRASR_DT it generates a process number but it also gives an error workflow could not start.I get following error (SWIA log - Step history)
Executing flow work item - Transaction brackets of the workflow has been damaged
Exception occurred - Error when starting work item 000000007031
PROCESS_NODE - Error when processing node '0000000014' (ParForEach index 000000)
CREATE - Error when creating a component of type 'Step'
CREATE_WIM_HANDLE - Error when creating a work item
CREATE_VIA_WFM - Exit CL_HRASR00_POBJ_WF_EXIT triggered exeception for event CREATED and (target) status
EVENT_RAISED - Error updating the process object
Executing flow work item - Exit CL_HRASR00_POBJ_WF_EXIT triggered exeception for event STATE_CHG and (target) status READY->ERROR
EVENT_RAISED - Error updating the process object
Executing flow work item - Transaction brackets of the workflow has been damaged
Executing flow work item - Work item 000000007031: Object FLOWITEM method EXECUTE cannot be executed
Executing flow work item - Error when processing node '0000000014' (ParForEach index 000000)
Points to be noted:
1) I have searched few SAP notes such as 1384961(Notes for 6.0.4) but our system is in higher level patch 6.0.5
2) WF-BATCH have SAP_NEW and SAP_ALL authorization.
Appreciate your valuable suggestions.
Thanks
Ragav

Hi Ragav
did you try to debug this? maybe something is missing in config of P&F?
Since you are on 605, the following note would be there in your system....use it to debug:
1422496 - Debugging background workflow tasks in HCM P&F
This will help you find the root cause.
regards,
modak

Fetching Alert for Particular Product and Location

Hello,
This is on ABAP side..
I just wanted to know whether its possible to fetch alerts for Pariticular material and Location.
I checked the method Read_alerts in Class /sapapo/alert_manager, but its not working. Any suggestion on this are welcome.
Please do suggest..
Thanks in Advance,
Srini

Did you try using BAPIs BAPI_SYSTEM_ALERT_GETDETAILS ?

Problem with Symantec Endpoint protection and iCloud

iCloud does not function on my PC with Symantec Endpoint Protection. I think it is the stopping of Auto-run that is the problem, but I don't know how to solve this

Hi Xung,
Can you elobrate as what is that you are trying to achive and its blocking
IS it TMG not getting updated
Client is unable to get live update from internet
SEPM manager unable to get updates ?
can you do a logging and share the screenshot of the traffic getting blocked.
If TMG is unable to get updates then allow the belwo
From : Localhost
To : SEPM / GUP servers
Port : 2967 - Outbound and 8014 Outbound
Allow for All Users

Looking collection query for WMI Issue and obsolete computer list

Hi
I want to create collection based on client having below issue.
WMI Issue and obsolete
in one query.
Kindly paste it

hi Gokul,
If you install the client status reporting tool on your environment its easy to find out the client health issues with a report and for the obsolete entry query
Client status reporting tool use http://technet.microsoft.com/en-us/library/cc161853.aspx
http://rajsavi.wordpress.com/2012/08/20/installation-and-configuration-of-client-status-reporting-tool-for-sccm/
WQL for duplicate entry:
http://eskonr.com/2012/10/sccm-collectionreport-duplicate-computer-names-with-different-resource-id/
Kamala kannan.c| Please remember to click “Mark as Answer” or Vote as Helpful if its helpful for you. |Disclaimer: This posting is provided with no warranties and confers no rights

Help with Application for Endpoint Protection

I created an application to install System Center Endpoint Protection, because we are using Symantec Endpoint Protection 12.1.3, which is unsupported for SCEP to remove. With the application I set it to supersede our SEP 12.1 client and remove
any previous software. I created a previous thread, located here:
http://social.technet.microsoft.com/Forums/en-US/38a476b3-0e71-4e80-b348-81143fa5cefe/creating-an-application-for-sc-endpoint-protection?forum=configmanagergeneral.
The initial test works, our SEP is removed and SCEP is installed, however the client takes anywhere from 3-5 hours before SCEP pulls down the correct Anti-Malware policy and applies the latest definitions. The time frame for this is longer then
we want, rebooting the computer or going into the SCCM client and running the actions does not seem to speed up the process.
At the moment, the command that works is "scepinstall.exe" /s /q,
what I attempted to do was export the current anti-malware policy and run the command
"scepinstall.exe" /s /q /policy "Malware.xml", however this does not seem to work, in SCCM or running the command via a command prompt. The only way it would is if I fully defined the path the of the xml such
as, scepinstall.exe /s /q /policy C:\Windows\CCMCache\2\malware.xml, but this command does not work in SCCM, only via the command prompt. As well defining the policy doesn't seem to do anything, when I open SCEP, I cannot enter the history
or settings tab. Even if it did I could not guarantee that the path would remain constant.
It seems odd that it can take 3-5 hours before SCEP pulls down its policy, is this normal when installing without a defined policy?
Is there a setting that I need to change somewhere that is defining when the client can check in for a new Anti-malware policy? The SCCM client is checking the default time of 60 mins.
Is there a way to define the policy on the install any other way?
Is there something I am missing?

Hi,
I normally use a custom task sequence when swithing the antivirus, here is a great way of doing it solving the initial download of the definition updates as well from a package works great for OSD as well.
http://www.chrisnackers.com/2012/10/18/configuration-manager-2012-installing-endpoint-protection-during-a-task-sequence/
using the cache\2 is not a really good idea as it will not be same between computer, put the command line in a .cmd file and use the %~dp0 variable for current directory "scepinstall.exe /s /q /policy %~dp0EPAMPolicy2.xml" .
Regards,
Jörgen
-- My System Center blog ccmexec.com -- Twitter
@ccmexec

System Center Endpoint Protection Antimalware client version - wont upgrade

Hi
Running SCCM 2012 SP1 CU4 on Server A. Endpoint Protection role on Server B. Both Servers 2008 R2. there is only one primary site server and no secondary sites in the hierarchy.
All clients are Windows 7.
The SCEP client is not upgrading on clients as I would have expected. After enabling the automatic client upgrade option in site hierarchy settings I found all the clients upgraded their SCCM agent. I was expecting the SCEP client to be upgraded also. Machines
have been rebooted since the SCCM agent upgrade.
How can I go about upgrading the SCEP agent on all computers?
Many thanks

Hi Daniel
I can't find this file in %programfiles%\microsoft configuration manager\logs, or %programfiles%\sms_ccm\logs. Can you tell me where this log file is?
I think I sorted the issue, some of the boundaries weren't in a boundary group. Now some of the SCEP agents are upgrading. There are still some issues but I guess I'll do some reinstalls and see if I can resolve this this way.
Common installation issues I'm seeing are 0x8004FF91 or 0x8000ffff,
for example. These are found in the c:\windows\ccm\logs\EndpointProtectionAgent.log on the clients.
Thanks

Remove Microsoft Endpoint Protection 2012 Client

Hi,
I ended up with Microsoft Endpoint Protection 2012 on my private PC and I can't get rid of it.
When I try to uninstall it via the "Programs and Features" dialogue the "Uninstall" or "Change" button disappears everytime I select the endpoint entry. Wild guess, this is due to a group policy setting.
So my question is, which group policy do I have to change to successfully uninstall the client without having to reinstall my whole system.
Thanks
Simon

Hi
Thank you for your post here.
Please read the articles below to see if they are helpful.
http://support.microsoft.com/kb/2834133
http://technet.microsoft.com/en-us/library/gg477040.aspx
Best Regards
Quan Gu

Alerts for Receiver Adapter and Synchronous Messaging

Hi experts,
I am working on XI 3.0 SP 17. I am doing alert configuration in XI . In below 2 cases we didn't receive alerts for errors.
1) In case of errors in receiver adapters.
2) If an error occurs in synchronous message processing.
What would be the Problem?
Please help me out its very urgent.
Regards,
Hari

Hi Hari
For raising the alert related to Adapter specific you need to create alert rule in RWB and select the adapter option and then select the adapter for which u want to raise an alert.
To configure your alerts, proceed as follows:
● Create the alert categories that you want to use in your alert rules.
● Create the alert rules in which you want to use your alert categories.
http://help.sap.com/saphelp_nw04/helpdata/en/80/942f3ffed33d67e10000000a114084/frameset.htm
/people/michal.krawczyk2/blog/2005/09/09/xi-alerts--step-by-step
check this links.
https://www.sdn.sap.com/irj/sdn/forums
/people/michal.krawczyk2/blog/2005/09/09/xi-alerts--step-by-step
Trouble shooting Alert configuration:
/people/michal.krawczyk2/blog/2005/09/09/xi-alerts--troubleshooting-guide
/people/michal.krawczyk2/blog/2005/06/28/xipi-faq-frequently-asked-questions
Alert Inbox
http://help.sap.com/saphelp_nw04/helpdata/en/80/942f3ffed33d67e10000000a114084/frameset.htm
Alert Notification Step-by-Step
http://help.sap.com/saphelp_nw04/helpdata/en/49/cbfb40f17af66fe10000000a1550b0/frameset.htm
Defining Alert Classifications
http://help.sap.com/saphelp_nw04/helpdata/en/49/cbfb40f17af66fe10000000a1550b0/frameset.htm
Triggering Alerts
http://help.sap.com/saphelp_nw04/helpdata/en/49/cbfb40f17af66fe10000000a1550b0/frameset.htm
Setting up alerts
Setting up alerts in RZ20
Alert Management
https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/e04141e8-0f11-2a10-adaa-9d97b062c2df
Alert Notification
https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/90f449a8-a6db-2910-a386-d2b5999f5751
Custom Alerts in CIC Win Client for CRM 5.0
https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/601db2b2-2839-2a10-0381-8807979f6ff8
Understanding u'r SAP EarlyWatch Alert Report
https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/4b88cb90-0201-0010-5bb1-a65272a329bf
regards
Sandeep Sharma
If helpful kindly reward points

System Alerts for Bank Guarantees and Letter of Credits

Hi
My requirement is to get system alerts when the the Letter of Credit(LOC) or Bank Guarantee (BG) is going to be expired.
We are using Third Party software for master data and other information related to Letter of credit.
In SAP ,I will do special GL for LOC and assign to Reconciliation Account as per standard.
What is the best practice to get system allert, when ever the date is going to get expired.
Many Thanks In advance
Rama

Hi,
In case you want to send the last record only, then you can use following qurey
SELECT TOP 1 * FROM DBO.OVPM T0 WHERE T0.CashSum >= 10000 AND DATEDIFF(DD, T0.CreateDate, GetDate()) = 0 ORDER BY T0.CreateDate DESC
then in Alert u can set the frequency as 1 minute.
Hope this helps...
BR
Samir Gandhi

Question on best practice for NAT/PAT and client access to firewall IP

Imagine that I have this scenario:
Client(IP=192.168.1.1/24)--[CiscoL2 switch]--Router--CiscoL2Switch----F5 Firewall IP=10.10.10.1/24 (only one NIC, there is not outbound and inbound NIC configuration on this F5 firewall)
One of my users is complaining about the following:
When clients receive traffic from the F5 firewall (apparently the firewall is doing PAT not NAT, the client see IP address 10.10.10.1.
Do you see this is a problem? Should I make another IP address range available and do NAT properly so that clients will not see the firewall IP address? I don't see this situation is a problem but please let me know if I am wrong.

Hi,
Static PAT is the same as static NAT, except it lets you specify the protocol (TCP or UDP) and port for the local and global addresses.
This feature lets you identify the same global address across many different static statements, so long as the port is different for each statement (you CANNOT use the same global address for multiple static NAT statements).
For example, if you want to provide a single address for global users to access FTP, HTTP, and SMTP, but these are all actually different servers on the local network, you can specify static PAT statements for each server that uses the same global IP address, but different ports
And for PAT you cannot use the same pair of local and global address in multiple static statements between the same two interfaces.
Regards
Bjornarsb

DPM Servers for server protection and SQL

As per article TechNet article(Preparing the DPM SQL Server database)
http://technet.microsoft.com/en-us/library/jj852163.aspx
, observed following notes on this TechNet section,
Ø
You cannot use an instance of SQL Server running in a cluster for DPM.
Ø
You cannot use a SQL Server AlwaysOn deployment
But while Installing DPM 2012 R2 Prerequisites asking two options, 1. Use standalone 2. Clustered SQL Server,
Query 1: Can I use Cluster SQL for DPM Database
Query 1: I am plan to setup Server protection for server is my DC’s (Named DC1 and DC2), Can I use DPM Chaining to protect each other or advise which protection method is better
( Cyclic Protection or DPM Chaining

Hi,
This page
Preparing the DPM SQL Server database has information for DPM 2012 and 2012 SP1 and a separate section for DPM 2012 R2. It seems you looked under the wrong section.
SQL Server requirements for DPM in System Center 2012 and System Center 2012 SP1
-You cannot use an instance of SQL Server running in a cluster for DPM.
-You cannot use a SQL Server AlwaysOn deployment.
SQL Server requirements for DPM in System Center 2012 R2
-Using an instance of SQL Server running in a cluster is supported.
-You cannot use a SQL Server AlwaysOn deployment.
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread. Regards, Mike J. [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights.

CCMSPING Alerts for offline systems and agents

At the moment we monitor our systems with ccmsping and let send alerts for the following MTS classes:
Availability_SysPercent_ABAP
Availability_InstPercent
Availability_RFCPercent
Availability_GroupPercent
CsmTaskR3Instance.Availability
CsmTaskR3Instance.Heartbeat
Now the problem is, the alert will be generated only once for every threshold value. Once for green to yellow, from yellow to red and for zero availability. But we would like to send in a regular interval a mail for non availability to identify really offline systems or network gabs.
I've tried to change the following settings:
Which alerts should be kept?
Display all-clears in alert browser?
Set "Value Obsolete" and Inactive after
Also Trigger Heartbeat LAert?
But we have only three alerts for green to yellow, yellow to red and zero availability and nothing more.
What I have to do, to send mor the one alert for offline systems.

Hello Rene,
For performance MTEs it is only possible to raise an alert if the threshold is exceeded as you describe. This raises an alert only once because the threshold was met only once. I do not believe there is a standard method to repeat alerts without resetting the alert because what you describe is operating as designed. So there is no standard setting for this.
Regards,
Brendan

Collection Alerting for Endpoint Protection and Client Status

Similar Messages

Maybe you are looking for