Under Home tab, total endpoint showing is incorrect SEP count.

book

Article ID: 198880

calendar_today

Updated On:

Products

Endpoint Protection

Issue/Introduction

Under Home tab, total endpoint showing is incorrect information compare to computer status report.

Cause

From the database found that, NPVDI client count is high, indicating that they're properly marked.

Looked into AgentSweeping log and found the following:

2020-06-25 00:05:14.612 THREAD 52 FINE: check oldest failed replication time, finished, return: 1571369483164
2020-06-25 00:05:14.612 THREAD 52 FINE: AgentSweepingTask>> sweepAgents: oldestFailedReplicationTime (ms)=1571369483164
2020-06-25 00:05:14.612 THREAD 52 WARNING: AgentSweepingTask>> sweepAgents: Adjusted oldestUpdateTime and oldestUpdateTimeNPVDIClients (ms)=1571369483164 1571369483164
...

2020-06-25 00:05:14.626 THREAD 52 WARNING: AgentManager>> deleteOldAgents: Begin... oldestUpdateTime=1571369483164, oldestUpdateTimeNPVDIClients=1571369483164
2020-06-25 00:05:14.647 THREAD 52 FINE: update SEM_AGENT set USN=?, DELETED=? where DOMAIN_ID = CONVERT(CHAR(32),?) AND DELETED = 0 and ( (LAST_UPDATE_TIME < ?) or (IS_NPVDI_CLIENT = 1 and LAST_UPDATE_TIME < ?) )

Looked into restored SEPM environment and found that the last replication time for site XXXXX is 10/17/2019. 11:31PM  The time stamp in log is evaluated to 1571369483.164 => 10/18/2019 @ 3:31am (UTC).

Customer has a replication site which they were not using but replication is still enabled.

Environment

SEPM: 14.2 (Replication)

Resolution

Once the replication is corrected and started replication to each site. Endpoint status is showing correct data.