Efecto de los agentes

You can edit alert messages in the following two ways: „ Changing alert priority.

Changing alert priority

Some of the alerts that Alert Manager receives from your client anti-virus software require more immediate attention than others. A default priority level is set for each alert message, corresponding to the urgency most system administrators would assign them. You can reassign these priority levels to suit your own needs. Use them to filter the messages that Alert Manager sends to your recipients so your recipients can concentrate on the most important ones first.

To change the priority level assigned to an alert message:

1 On the Alert Manager Messages dialog box (see Customizing alert messageson page 181), click a message in the list once to select it.

2 Click Edit to open the Edit Alert Manager Message dialog box.

3 Choose a priority level from the Priority list. You can assign each alert message a Critical, Major, Minor, Warning, or Informational priority.

The icons shown beside each message listed in the Alert Manager Messages

dialog box identify the priority level currently assigned to a message. Each icon corresponds to a choice in the Priority drop-down list. The priority levels are:

Critical. Indicates your anti-virus software detected viruses in files that could not be cleaned, quarantined or deleted.

Major. Indicates either that successful virus detection and cleaning has occurred or that serious errors and problems that might cause your anti-virus software to stop working. Examples include “Infected file deleted,” “No licenses are installed for the specified product,” or “Out of memory!”

Minor. Indicates lesser detection or status messages.

Warning. Indicates status messages that are more serious than informational messages. These often relate to non-critical problems

Informational. Indicates standard status and informational messages, such as “On-Access scan started” or “Scan completed. No viruses found.” As you reassign the priority for a message, the icon beside it changes to show its new priority status.

4 Click OK.

Filtering messages by priority level

To filter your messages, configure each alert method you have set up in Alert Manager to accept only messages of a certain priority. For example, suppose you want to have Alert Manager page you whenever your client anti-virus software finds a virus on your network, but do not want it to send routine operational messages. To do this, you would assign a Critical or Major priority to virus alerts, and a Minor, Warning, or Informational priority to the routine informational messages. Then, configure Alert Manager to send only high priority messages to the e-mail address that goes to your pager.

See Setting the alert priority level for recipientson page 157 for information about applying priority level filters for specific recipients.

Editing alert message text

To help you respond to a situation that requires your attention, Alert Manager includes enough information in its messages to identify the source of whatever problem it has found and some information about the circumstances in which it found the problem. You can edit the message text as desired. For example, you can add comments to the alert message that describe more about the problem or list support contact information.

NOTE

Although you can edit the alert message text to state what you want, you should try to keep its essence intact, because Alert Manager sends each message only when it encounters certain conditions. Alert Manager sends the “task has started” alert message, for example, only when it starts a task.

To edit the alert message text:

1 From the Alert Manager Messages dialog box, click the alert message in the list to select it.

2 Click Edit to open the Edit Alert Manager Message dialog box.

3 Edit the message text as desired. Text enclosed in percentage signs, such as %COMPUTERNAME%, represents a variable that Alert Manager replaces with text at the time it generates the alert message. See Using Alert Manager system variableson page 185.

Using Alert Manager system variables

Alert Manager 4.7 includes system variables that you can use in alert message text. These variables refer to system features like system date and time, file names, or computer names. When sending alert notifications, Alert Manager dynamically replaces the variable with a specific value.

For example, the major alert Infected file successfully cleaned (1025) listed in the

Alert Manager Messages dialog box is by default set to the following:

The file %FILENAME% was infected with %VIRUSNAME% %VIRUSTYPE%. The file was successfully cleaned with Scan engine version %ENGINEVERSION% and DAT version %DATVERSION%.

When this alert is sent to Alert Manager from an anti-virus application, Alert Manager dynamically populates the system variables with real values, for example displaying MYDOCUMENT.DOC for the %FILENAME% variable.

Some of the most commonly-used system variables are:

%DATVERSION% _{The version of the current DAT files used by the} antivirus software that generated the alert. %ENGINEVERSION% _{The version of the current antivirus engine used by}

the antivirus software to detect an infection or other problem.

%FILENAME% The name of a file. This could include the name of an infected file it found, or the name of a file it excluded from a scan operation.

%TASKNAME% The name of an active task, such as an On-Access scan or AutoUpdate task in VirusScan Enterprise. Alert Manager might use this to report the name of the task that found a virus, or the name of a task that reported an error during a scan operation. %VIRUSNAME% The name of an infecting virus.

%DATE% The system date of the Alert Manager computer. %TIME% The system time of the Alert Manager computer. %COMPUTERNAME% The name of a computer as it appears on the

network. This could include an infected computer, a computer that reported a device driver error, or any other computer with which the program interacted.

%SOFTWARENAME% The file name of an executable file. This could include the application that detected a virus, an application that reported an error, or any other

WARNING

Be careful when editing message text to include system variables that might not be used by the event generating that alert message. Using system variables in alerts that do not use that system variable field could cause unexpected results, including garbled message text or even a system crash.

Following is a complete list of the Alert Manager system variables that can be used in Alert Manager messages:

%SOFTWAREVERSION% The version number taken from an active software package. This could include the application that detected a virus, an application that reported an error, or any other application with which the program interacted.

%USERNAME% The login name of the user currently logged on to the server. This can, for instance, inform you if somebody cancelled a scan.

%ACCESSPROCESSNAME% %CLIENTCOMPUTER% %COMPUTERNAME% %DATVERSION% %DOMAIN% %ENGINESTATUS% %ENGINEVERSION% %EVENTNAME% %FILENAME% %GMTDAY% %GMTHOUR% %GMTMIN% %GMTMONTH% %GMTSEC% %GMTTIME% %GMTYEAR% %INFO% %MAILIDENTIFIERINFO% %MAILSUBJECTLINE% %MAILTONAME% %NOTEID% %NOTESDBNAME% %NOTESSERVERNAME% %LANGUAGECODE% %LOCALDAY% %LOCALHOUR% %LOCALMIN% %LOCALMONTH% %LOCALSEC% %LOCALTIME% %LOCALYEAR% %LONGDESCRIPT% %MAILCCNAME% %MAILFROMNAME% %NUMCLEANED% %NUMDELETED% %NUMQUARANTINED% %NUMVIRS% %OBRULENAME% %OS% %PROCESSORSERIA% %RESOLUTION% %SCANRETURNCODE% %SEVERITY% %SHORTDESCRIPT% %SOFTWARENAME% %SOFTWAREVERSION% %SOURCEIP% %SOURCEMAC% %SOURCESEG% %TARGETCOMPUTERNAME% %TARGETIP% %TARGETMAC% %TASKID% %TASKNAME% %TRAPID% %TSCLIENTID% %URL% %USERNAME% %VIRUSNAME% %VIRUSTYPE%

7

Updating

The VirusScan Enterprise software depends on information in the virus definition (DAT) files to identify viruses. Without updated files, the product software might not detect new virus strains or respond to them effectively. Software that is not using current DAT files can compromise your virus-protection program.

New viruses appear at the rate of more than 500 per month. To meet this challenge, McAfee Security releases new DAT files every week, incorporating the results of its ongoing research into the characteristics of new or mutated viruses. The

AutoUpdate feature makes it easy to take advantage of this service. It allows you to download the latest DAT files, scanning engine, and EXTRA.DAT simultaneously, using an immediate or scheduled update.

The following topics are addressed in this section: „ Update strategies

„ System variables „ AutoUpdate tasks

„ AutoUpdate repository list „ Mirror tasks

„ Rollback DAT files „ Manual updates