An Agent Handler (AH) contacts the database every 60 seconds. If the Apache service goes down for more than 5 minutes, it creates
Event ID 16025. The event information is stored in the
EPOServerEvents table. The article helps you to set up an email notification when the event occurs.
How to check the event details from the ePO database via an SQL query:
- Log on to SQL Management Studio.
- Expand Databases in Object Explorer.
- Right-click the database name for your ePO server, and click New Query.
See the related article KB67591 - How to run a SQL script provided by Technical Support against the ePolicy Orchestrator database.
- Paste the script provided into the query window.
- Click Execute or press F5.
Select * from EPOServerEvents where EventID = '16025' order by EventTime DESC
NOTES:
INFO [scheduler-TaskQueueEngine-thread-26] task.TaskInvocation - Agent Handler Status Task.
INFO [scheduler-TaskQueueEngine-thread-26] agentmgmt.AgentHandlerStatusTask - Running agent handler status task
INFO [scheduler-TaskQueueEngine-thread-26] task.TaskInvocation - Agent Handler Status Task. (Successfully created Agent Handler status server tasks.)
To create an automatic response for this Apache service down state, follow the steps given below:
- Log on to the ePO console.
- Click Menu, Automation, and Automatic Responses.
- On the Description tab, take the following actions:
- In the Name field, provide a name for the Automatic Response.
- In the Event section, populate the following two fields with the stated settings:
- Event Group: ePO Notification Events
- Event Type: Server
- Set the status to Enabled.
- Click Next.
- On the Filter tab, take the following actions:
- In the left pane, select the Event ID.
- In the right pane, under Comparison, select Contains.
- In the right pane under Comparison Value, type the following ID number: 16025
- Click Next.
- On the Aggregation tab, use the default settings, and click Next.
- On the Actions tab, take the following actions:
- Under the question, "What actions do you want this response to take when triggered?," use the drop-down list, and select Send Email.
- In the Recipients field, provide an email address.
NOTE: Multiple email addresses can be entered, but must be separated by a semicolon (;).
- Populate the Subject field with the following text:
Agent Handler_Inactive | {LISTOFADDITIONALINFO} |
- In the Body section, use the Insert variable drop-down list, and select the following options:
- List of All Values
- Additional Information
- Click Next.
The screenshot below shows the above-implemented settings:
- On the Summary tab, click Save.
NOTE: Make sure that the email server is configured from the Server Settings page. If you've not set up the email server, the following message is displayed:
Email server settings are not configured
To test this Automatic Response, stop the Apache service on ePO or the Remote Agent handler server:
- Press Windows+R.
- Type services.msc into the field and press Enter.
- Right-click the following ePO service and select Stop:
McAfee ePolicy Orchestrator #.#.# Server
- Wait for 5–6 minutes. After the Apache service is stopped on the Agent Handler, it triggers the following to be generated:
- Event ID 16025
- Event description Agent Handler down (Info)
- Start the ePO Server service.
- Close the services window.
The screenshot shows the Event ID 16025 and Event defined description
.png)
