There are several methods to troubleshoot inventory issues in your environment.
For details about Minimum Data Collection to troubleshoot Trellix Application and Change Control, see KB90755.
Perform the steps in this section if you are experiencing issues with Inventory not present:
Make sure ePO - SaaS server services are running.
Make sure that the client is solidified.
Verify Inventory Fetch Time (Last and Next).
If Inventory time is greater than 7 days, rerun the Pull task.
If Inventory time is less than 7 days, run the Inventory time reset task. To reset Last time inventory sync on client, run the following commands:
sadmin config set InvDiffLastAccessTime=default
sadmin config set PullInvLastAccessTime=default
Note
7-day interval is the default value.
Verify whether you have modified the Pull Complete Inventory Interval value in the Application Control Options policy. Adjust the timing accordingly. Rerun the Inventory Pull task if it fails.
Pull inventory manually by running the command
sadmin ls -rax > FILENAME.xml.Add filename.xml into the ePO event parser directory.
Verify eventparser.log for errors.
If rerunning the Inventory pull task, collect the following:
FILENAME.XML
MER and Gatherinfo from affected client
MER with ePO - SaaS Server and Orion debug logging
For details about Application Control command to reset throttling of events, policy discovery requests (observations), and inventory updates, see KB84348.
To reset the inventory-diff threshold on the endpoint, run the command sadmin reset-inv-diff-throttle. Inventory diff generation resumes on the endpoint after executing this command.
For details about Application Control Pull Inventory client task overview, see KB84247.
For details about Application Control corrupt inventory fallback process, see KB88222.
How to clear inventory time stamp
On ePO - SaaS:
Create SC: Run the following commands
config set InvDiffLastAccessTime=default
config set PullInvLastAccessTime=default
Send the task to the client.
On Client:
Open Command Prompt with administrator's rights.
Recover the local CLI by executing sadmin recover. A password is needed to unlock the local CLI.
Run the following commands:
sadmin config set InvDiffLastAccessTime=default
sadmin config set PullInvLastAccessTime=default