CSA 5.1 - Test Mode Issue

Unanswered Question
Apr 17th, 2007

We have a number of hosts who were in test mode, enabled full protection and then they move back into test mode within a day. There is no event generated and these hosts are part of a larger group of XP desktops that operate properly.

TAC suggested us to reinstall the agent, however this did not solve the issue and the systems continue to exhibit this behavior.

Has anyone experience this oddity?

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
tsteger1 Wed, 04/18/2007 - 11:45

How were they put into test mode?

Were they deployed that way with an agent kit, moved to a group, or already part of a group that was then put in to test mode?

jmutuski Wed, 04/18/2007 - 12:44

They were initially deployed through an agent kit in test mode. After a period of testing/tuning, the entire group was put in protect mode. Now we have a small set of hosts that move back into Test mode with no interaction by and end user or administrator.

tsteger1 Wed, 04/18/2007 - 17:08

Sorry, more questions...

When you say "move back into test mode" is it via group membership (complete test mode) or rule module (partial test mode)?

Do you have any host managing tasks that move hosts to or from groups at specified intervals?


jmutuski Wed, 04/18/2007 - 17:51

They hosts show back in the Test Mode group. There are no host managing tasks to move any host to any group.

tsteger1 Wed, 04/18/2007 - 22:20

Sorry, I guesss I'm a bit confused. I thought you changed the original group from test to protect but it sounds like you moved them to a protect group.

It sounds like something I've seen where hosts will disassociate themselves on their own. They actually unregister from and reregister to the MC and end up in the original group they were deployed in.

Check the registration date and see if it corresponds with the time you saw them move to the test mode group.

If that's the case, you may have a configuration or communication issue on the hosts that are doing this.

I think TAC was trying to get you to install a kit that puts them in the group you want them to be in.

This is not an unknown problem but I don't know the solution.


Bam! That is the same one I was having issues with. Look to upgrade to 88 or 91 and your problems should be resolved.

My issue was very odd to where I would have hosts drop out of their groups and revert back to the installed agent kit. Which meant that any groups I had assigned after the kit was installed were now unassigned. This was a bad situation as we had used the standard kits for several hosts. These didn't include our exception policies or anything, so things were firing like mad, mucking up our reports.

***Side note, this did not happen with 66. I went ahead and got a hair and pushed 79 out to all hosts and then several days later these random problems began. I had a TAC open, but they only suggested the same thing, REINSTALL. It didn't work, then 88 became available, so I pushed it. That was the fix to my issues, and I hope it will be to yours.

tsteger1 Mon, 05/14/2007 - 11:17

I'm running 4.0.3-737. I haven't had it happen to any of the 5.X versions (yet).

TradeSecrets Tue, 05/08/2007 - 06:53

1) Make sure all the agent have the new policy.

Have the agents do a stop and start or reboot

2) Verify the problem host agents are in the Test mode group.

3) If the above do not work. check the logs on one of the problem host for further investigation

jmutuski Sun, 05/20/2007 - 12:09

Not yet as the client is a bit gunshy upgrading as the last time they did it resulted in a lost configuration. If/when I will update the thread.


This Discussion