Monitoring Symantec client for old virus definitions

[coolgagan13]

Is it possible to monitor below 2 situations via SEPM logs forwarded to Splunk via externla logging feature on SEPM console :

1. Virus definitions x days old - If we want to alert on machines which have Virus definitions X days old? This would help administrators look in to possible issues.

2. Components not function properly - For example auto protect not functioning. This should be reported and alerted.

Thanks,
Amar

[kylehillvt]

Making another pass at the same goals and thus came across your post. What we did initially was to feed Splunk files with our machine inventories and then monitored the virus definition signature version off of each client (those paths seem to evolve as SEP updates or by 32 vs 64 bit unfortunately). Our saved search does left joins (so we always get a record for every machine on inventory) on the two and by default the earliest was -24h. So the outliers would have null signature versions.

The one other key detail was (with 4.2.. again revisiting) we had to use a separate inventory file vs Splunk's feature. That was the only way to perform the join vs a look-up at the time and it was easier to automate than automating the update of the CSV on the server.

-Kyle