|jtennys||Report on systems not reporting in?|
|4th Feb, 2012 19:32|
User Since: 1st Jan, 1970
System Score: N/A
Is there a way to create a report that reports on systems that haven\'t reported in > n days?
I had a bunch of systems that hadn\'t scanned in over 30 days because the IPs changed on csi5.secunia.com (my firewally you have to put in IPs) and I had no idea until I went in and checked on something else.
|jlbalvanz||RE: Report on systems not reporting in?|
|6th Feb, 2012 23:56|
User Since: 19th May 2011
System Score: N/A
|I have a PowerShell script that does this, but it boils down to opening the local Secunia database in SQLite3 ("sqlite3 databasefilename") and executing this SQL:
select nsi_devices.host, nsi_devices.langroup, nsi_devices.updated from
nsi_devices inner join (select host, langroup, updated from nsi_devices where
updated < '2012-01-07') old_machines on nsi_devices.host=old_machines.host EXCEPT
select nsi_devices.host, nsi_devices.langroup, nsi_devices.updated from nsi_devices
inner join (select host, langroup, updated from nsi_devices where
updated >= '2012-01-07') new_machines on nsi_devices.host=new_machines.host
order by nsi_devices.updated;
Put whatever date is appropriate in the correct locations. This will give you a list of machines that haven't checked in since the date listed in columns separated by vertical bars; you can import that into Excel or LibreOffice Calc and make it prettier if you need to. See the CSI documentation for the location of the database.
Jeff Balvanz -- Iowa State University Information Technology Services
Ames, IA, USA
Not a customer already?
Learn more about how our market leading Vulnerability Management solutions can help you manage risk and ensure compliance.