4 Replies Latest reply on Aug 4, 2008 2:22 AM by phoffmann

    Why the inventory scan got succeed after vulscan.exe run.

    Rookie

       

      Hi all.

       

       

      Now we use the v8.7 SP2 Core server and support handreds of clients which are serveral versions.

      Few years ago,We changed Core Server's IP address.(Same Name)

       

      Now, I tried to test v8.6.1 client agent which was maden before changing Core Server's IP address.

      After I installed it to the test machine,I could find the device name of that on the core server but I failed Inventory scan with GUI(it means that pointing the device -> right clicked -> Inventory scan).

      the dialog said  "Lose connection" 

       

      After that I run security scan from core server to the test device and then I retried to do inventory scan of it.

      So the scanning  finished successfully.

      I don't figure out Why the procedure was success after the vulscan.exe had been run on the client machine.

       

       

      What I want to ask is the reason why the inventory scanning have gotten succeed after Inventory scan runs on the v8.6 agent.

      Does any one have infomation about that ?

       

       

      thanks.

       

       

        • 1. Re: Why the inventory scan got succeed after vulscan.exe run.
          phoffmann SupportEmployee

          Well - in theory, the two are utterly disconnected.

           

          The only thing that I can think of as being likely is that when vulscan ran, it would/might autofix the firewall settings for your client to allow LANDesk traffic to go through.

           

          Since ... much like any other software - if the firewall blocks communication, there's not much we can do :).

           

          Paul Hoffmann

          LANDesk EMEA Technical Lead.

          1 of 1 people found this helpful
          • 2. Re: Why the inventory scan got succeed after vulscan.exe run.
            Rookie

             

            Thanks Paul.

             

            >> Well - in theory, the two are utterly disconnected.

            Certainly,Of course I did edit hosts file on the clients devices before Install. I'm sorry the infomation was ommited.

            I found the following strings while the install program was running.

            "AMTConfig.exe xxx.xxx.xxx.xxx" <- XXX is Core Server's old IPaddress.

                 (what is the amtconfig.exe ?)

             

             

            >>The only thing that I can think of as being likely is that when vulscan ran, it would/might autofix the firewall settings for your client to allow LANDesk traffic to go through.

            Umm.Most of all cliants we handle are working as Server machine(Windows server 2000 or 2003 or NT etc).So they are always configured as the firewall is cut off.

            I did'nt changes at all except editting hosts file.

             

             

            It was very strange.

             

             

            • 3. Re: Why the inventory scan got succeed after vulscan.exe run.
              Rookie

               

              Hi all.

              I got hints from some references(vulscan.log and proxyhost.log, referrences and so on).

              According to them,I guess following.

               

              Vulscan.exe runs self update procedure when it is called first.at that time some dinamic link library(dll) seems to be update at the same time,So once vulscan.exe run,We can scan inventory with console application by GUI.

               

              Is that true?

              if so, when we change the configure of core server especially inportant setting like IP address or version up and so on,Client devices run the security scanning before inventory scanning.

               

               

              thanx.

               

               

              • 4. Re: Why the inventory scan got succeed after vulscan.exe run.
                phoffmann SupportEmployee

                So - AMTCONFIG is essentially "our interface to AMT" ... you may know it as "VPRO" potentially. It's a desktop Management Standard introduced by Intel.

                 

                Vulscan auto-updates itself every time it runs (i.e. - it checks "I am version X - what version does the Core Server have?"). If the Core has a newer version of VULSCAN, it'll auto-update itself and re-launch. So if I read your question correctly, then "yes, this is true - vulscan does self-update".

                 

                Whether this self-update resolves whatever issue you have, I can't say (and I don't see how it would). But it sounds like your agent configuration has got your Core's IP mixed up with an old one...?

                 

                Paul Hoffmann

                LANDesk EMEA Technical Lead