## Monitoring client state and activity

You can write calls to the Windows Event Log or to the Symantec public registry key location to monitor any supported Symantec Endpoint Protection logging. This topic provides a verbose English description of the basic client data that is recommended for monitoring. The retrieval details are documented in script snippets.

See Client monitoring examples.

Most of the client monitoring that is recommended here is operational state, and is therefore implemented by monitoring the registry. All supported registry subkeys are located under the registry key HKLM\SOFTWARE\Symantec\Symantec Endpoint Protection\CurrentVersion\Public-Opstate.

See Operational state reference.

Additional events are logged in the Windows Event Log that let you extend client monitoring beyond what is recommended here.

See Client events.

To remediate any infected or at risk endpoints, you can run commands on the endpoints by using a web services client application.

See Running commands on clients.

The following table describes calls to endpoint state on individual clients. Some of these calls are useful to roll up for summary network status information, but others require additional calculations to provide meaningful reporting.

Table: Simple client monitoring (single condition only)

Client state or datum | Description | How to monitor | Notes
--- | --- | --- | ---
Infected | The endpoint is infected with one or more threats that were detected by Virus and Spyware Protection. | Monitor the Infected registry subkey. Key value == 1 means that the client is infected. Key value == 0 means that the client is not infected. | An infected endpoint may be up-to-date or out-of-date. Remediation steps are the same in either case.
Note: | Infected state is not reported on an endpoint that reports only threats that are detected by Network Threat Protection.
Note: | This key is not created until after the client runs a scan for the first time.
Up-to-date | The endpoint has current virus definitions and other product content. | Subtract 3 days from today's date, in PDT to get the threshold date. If today is 27-Sep-2011, the threshold date is 24-Sep-2011. If the value of the LatestVirusDefsDate subkey is greater than the threshold date, then the endpoint is up-to-date. | We recommend that you use this call only to report on individual client state.
Note: | LatestVirusDefsDate is the date that is stamped into the set of virus definitions. It is not the date when the definitions were received by the endpoint. The definition date may be earlier than the current date on the endpoint, for example if the endpoint is in the eastern hemisphere and the virus definitions are published late in the day in California.
Out-of-date | The endpoint does not have current virus definitions and other product content. | See the up-to-date description. If the value of the LatestVirusDefsDate subkey is less than or equal to the threshold date, then the endpoint is out-of-date. | We recommend that you use this call only to report on individual client state. For the out-of-date roll-up call, see the following table of complex conditions.
Last scan time | The last time a scheduled scan or an on-demand scan for infections or risks was run on the endpoint | Monitor the most recent events from the Windows Event Log, log name Symantec Endpoint Protection Client, eventID 2. Get the value of the TimeWritten property from the most recent event in the list. |
Disabled | The endpoint has protection technologies disabled. | Monitor the AVRunningStatus subkey and the FWRunningStatus subkey. If either subkey value == 2, then client protection is disabled. If both subkey values == 1, then client protection is enabled. | Protection can be disabled on the management server or on the client if the policy allows it. Disabled protection may not be an at-risk state, depending on the individual client or on network policies. Multiple protection technologies write to these keys. See About Symantec Endpoint Protection.
Note: | Client protection is typically disabled for short periods of time, to permit legitimate client activity that would otherwise be blocked or slowed. It is generally not appropriate to report on disabled clients as unprotected.
Endpoint checking in/not checking in with management server | Endpoint that is connected to the Symantec Endpoint Protection management server or not checking in with the server | Monitor the most recent events from the Windows Event Log, log name Symantec Endpoint Protection Client, category Connectivity (eventID range 100 to 101). If the most recent eventID == 100, then the client is online and reporting to the management server. If the most recent eventID == 101, then the client cannot communicate with the management server. | Endpoints that are not checking in with the management server may not be at risk, particularly if they are roaming laptops.
Self-managed | Endpoint that is not managed by the Symantec Endpoint Protection management server | Monitor the LastServerIP subkey. If the subkey value is blank, or if the subkey is missing, then the client is self-managed. | A self-managed client may or may not be at risk. A self-managed state can occur if the client is installed by any method other than pushing a client installation package from the management server. In this case, a customer would want to remediate. In other cases, however, a self-managed state may be perfectly safe, and no remediation is required.
Client version number OR Client not installed | The version number of the Symantec Endpoint Protection client that is installed on the endpoint, or an uninstalled state | For a client that fully supports remote monitoring, look up the value of the DeployRunningVersion subkey. If this lookup fails, check for earlier client versions by looking up the value of this subkey under the registry key HKEY_LOCAL_MACHINE\​SOFTWARE\​Symantec\​Symantec Endpoint Protection\​SMC\​SYLINK\​SyLink\OpState\. | If neither subkey exists, then the client is not installed. The version number is a four-part string, such as 12.1.1047.347.

The following data points are recommended for summary monitoring of network health. Refer to the previous table and to the script snippets for details.

Note: | Roll-up calculations for healthy endpoints and out-of-date endpoints are slightly different from the calculations for individual endpoints.

Table: Summary (roll-up) client monitoring (overall network health)

Data point | Data point description | How to monitor | Notes
--- | --- | --- | ---
Healthy endpoints | Total number of endpoints that are not infected and and that have received current content (virus definitions and other client protection content). | Check whether the endpoints are both not infected and up-to-date. | This number includes only the endpoints that are online (that is, reporting to the remote monitoring tool).
Out-of-date endpoints | Total number of endpoints with out-of-date virus definitions and other client protection content. | Check whether the endpoints are both out-of-date and not infected. | This number explicitly excludes any endpoints that are infected. It reports on the endpoints that are out of date only. You may choose to monitor endpoint state differently, but if you monitor the out-of-date subkey only, some endpoints can be counted twice - once as infected, and once as out of date.
At risk endpoints | Rolls up the total number of endpoints that are out-of-date, disabled, self-managed, or without protection installed. | Check whether the endpoints are either out-of-date and not infected, or disabled, or self-managed, or without protection installed. | An endpoint can report more than one at-risk issue. This means that the total number of individual at-risk states does not necessarily equal the total number of at-risk endpoints.