This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Howto get rid of old entries in Endpoint protection

wk over 3 years ago

As you can see my endpoint protection is shown s active with 3 endpoints.

But my endpoint protection is turned off.

The 3 endpoint do not exist since years, but I find no way to delete them.

Searching the forum didn't help. When I look for help:

This screen tells me I can't change the settings anymore.

Can I do anything on the cli?

This thread was automatically locked due to age.

Parents

0 BAlfson over 3 years ago

Hallo,

What do you get from doing the following as root at the command line?

cc get epp endpoints

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Cancel
0 wk over 3 years ago in reply to BAlfson

Thanks Bob.

What I get is:

[
          'REF_EppEndWkx60s',
          'REF_EppEndX5pro',
          'REF_EppEndIna'
        ]

I know these Laptops, but they do not longer exist.
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 3 years ago in reply to wk

Walter, you will want to get Sophos Support to approve of you doing the following as I'm not certain there isn't something else you should do:

cc
epp
endpoints@
=[]

You should get:

result: 1

Finally:

exit

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Cancel
0 wk over 3 years ago in reply to BAlfson

Thanks Bob,

as this is only a home licence, support won't help me.

I tried your solution and got the right result.
Now after a reboot the command: cc get epp endpoints shows [] and no more endpoints are shown with

cc
epp
endpoints@

But on the webadmin screen nothing changed:

Endpoint Protection is active, Sophos LiveConnect is enabled, 3 endpoints, 0 thread alerts, 0 out-of-date alerts
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 3 years ago in reply to wk

Interesting... What do you see with:

cc get epp status

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Cancel
0 wk over 3 years ago in reply to BAlfson

{
          'av' => 1,
          'broker' => 1,
          'dc' => 1,
          'epp' => 1,
          'wc' => 0
        }
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 3 years ago in reply to wk

Ahhhh, just looked more closely at the first image in your opening post. What happens if you disable Sophos Live Connect in 'Endpoint Protection >> Web Control'?

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Cancel
0 wk over 3 years ago in reply to BAlfson

Bob I don't understand what I shall disable.

As you can see in the first post 'Endpoint Web Control' is disabled and there is no more switch on that screen.

Sophos LiveConnect is mentioned in the description of Endpoint Web Control but no possibillity to turn on or off.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 wk over 3 years ago in reply to BAlfson

Bob I don't understand what I shall disable.

As you can see in the first post 'Endpoint Web Control' is disabled and there is no more switch on that screen.

Sophos LiveConnect is mentioned in the description of Endpoint Web Control but no possibillity to turn on or off.
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 BAlfson over 3 years ago in reply to wk

If enabling/disabling doesn't fix it, Walter, I think it's time to get Sophos Support involved.

Cheers - Bob.
Cancel
Vote Up 0 Vote Down

Cancel

0 wk over 3 years ago in reply to BAlfson

Bob,
thank you for trying to help me with all your experience.

As said, it is a home licence so support won't help me.

But anyway it is not essential
It only shows a false information on the dashboard and writes a few bytes to the log every three hours that I can't interpret.

2022:04:08-01:00:44 fw epsecd[6150]: I id="424200" severity="info" sys="System" sub="epsecd" name="Parent proxy has changed re-connecting"
2022:04:08-01:00:44 fw epsecd[6150]: I id="4223" severity="info" sys="System" sub="epsecd" name="Closing socket to Sophos LiveConnect"
2022:04:08-01:00:45 fw epsecd[6150]: I id="4232" severity="info" sys="System" sub="epsecd" name="Not syncing web policy resources as web control is disabled"
2022:04:08-01:00:48 fw epsecd[6150]: I id="4231" severity="info" sys="System" sub="epsecd" name="Syncing SWC with web control global status "
2022:04:08-04:00:39 fw epsecd[6150]: I id="424200" severity="info" sys="System" sub="epsecd" name="Parent proxy has changed re-connecting"
2022:04:08-04:00:39 fw epsecd[6150]: I id="4223" severity="info" sys="System" sub="epsecd" name="Closing socket to Sophos LiveConnect"
2022:04:08-04:00:40 fw epsecd[6150]: I id="4232" severity="info" sys="System" sub="epsecd" name="Not syncing web policy resources as web control is disabled"
2022:04:08-04:00:43 fw epsecd[6150]: I id="4231" severity="info" sys="System" sub="epsecd" name="Syncing SWC with web control global status "
2022:04:08-07:00:47 fw epsecd[6150]: I id="424200" severity="info" sys="System" sub="epsecd" name="Parent proxy has changed re-connecting"
2022:04:08-07:00:47 fw epsecd[6150]: I id="4223" severity="info" sys="System" sub="epsecd" name="Closing socket to Sophos LiveConnect"
2022:04:08-07:00:48 fw epsecd[6150]: I id="4232" severity="info" sys="System" sub="epsecd" name="Not syncing web policy resources as web control is disabled"
2022:04:08-07:00:51 fw epsecd[6150]: I id="4231" severity="info" sys="System" sub="epsecd" name="Syncing SWC with web control global status "

0 BAlfson over 3 years ago in reply to wk

Ha ha - me, too, Walter!

I never noticed that before.

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Cancel
0 Amodin over 3 years ago in reply to BAlfson

I hope one day they can tie in Sophos Home to UTM/XG. Would be a nice feature. ;)
Cancel
Vote Up 0 Vote Down

Cancel