Pulse secure checking policies taking too long

[amjad.ra2]

Hello Guys,
I have configured HC to check more than one policy as below
1) Antivirus: check if the Symantec is installed or not and the scan was run within 5 days without checking the definition updated or not
2) antispyware: check if the agent installed or not.
3) Hard-disk encryption: check if all drivers encrypted or not
4) registry path: to check if the device Joined to the domain or not
5)Mac address: check if the device listed in the Mac Address list or not

When the client starts checking the compliance policies, it's taking too long and sometimes gives me a message says that the operation is rejected by the server.

What is the default time that must take to check the policies?
All the above policies configured in one HC policy, shall I Create an HC policy for each one? it may speed up the process !!

[flipPipe]

Hi amjad.ra2,

First you can check debuglog.log file and search for messages from OpswatImcColData

It will give times (in ms) of was the time each policy takes to evaluate.

Example

 'OpswatImcColData' Result of Antivirus data to monitor(Successfully called: CheckRTPState : Time Taken:23.8515, Successfully called: GetDataFileTime : Time Taken:10.7346, Successfully called: GetDataFileVersion : Time Taken:10.5312, Call failed: GetDataFileSignatures : Error Desc : Not supported, Call failed: IsUpdateInProgress : Error Desc : Not supported, Successfully called: IsFullScanInProgress : Time Taken:263.504, )

Regarding the timming, you can not have a rule of thumb for that, because it is heavly influenced by resources consumption in the client machine and by the caching mechanisms of pulse secure.

I'm doing tests for active patch policies, and depending of the end user computer and day, I've results as you, it fails by time out, other times, minutes to complete, other times just few seconds.

Chers,

[[email protected]]

@amjad.ra2 My best guess would be on the AntiSpyware and Antirvirus check, it might be taking too much time during the evaulat'ion. As @flipPipe rightly mentioned, please check the Pulse Client debug with the string mentioned "OpswatImcColData" and share the results with us.

[amjad.ra2]

Hi @flipPipe [email protected] ,

i checked the debug log and i found the below:

00345,09 2020/08/22 11:37:53.444 3 SYSTEM PulseSecureService.exe OpswatIMC p8436 t34C opsantivirusclientv4.cpp:261 - 'OpswatImcColData' Result of Antivirus API calls (Successfully called: FindInstalledProducts : Time Taken:138.08, Successfully called: GetProductVersion : Time Taken:2.5522, Successfully called: GetLastFullScanTime : Time Taken:1006.1)
00474,09 2020/08/22 11:37:53.563 3 SYSTEM PulseSecureService.exe OpswatIMC p8436 t34C opsantivirusclientv4.cpp:266 - 'OpswatImcColData' Result of Antivirus data to monitor(Successfully called: CheckRTPState : Time Taken:34.9401, Successfully called: GetDataFileDetails : Time Taken:20.045, Call failed: GetDataFileSignatures : Error Desc : Not supported, Call failed: IsUpdateInProgress : Error Desc : Not supported, Successfully called: IsFullScanInProgress : Time Taken:62.345, )
00288,09 2020/08/22 11:37:52.275 3 SYSTEM PulseSecureService.exe OpswatIMC p8436 t34C opsantispywareclientv4.cpp:82 - 'OpswatImcColData' Result of Antispyware API calls (Successfully called: FindInstalledProducts : Time Taken:171.686, Successfully called: GetProductVersion : Time Taken:20.4016)
00223,09 2020/08/22 11:37:52.296 3 SYSTEM PulseSecureService.exe OpswatIMC p8436 t34C opsantispywareclientv4.cpp:87 - 'OpswatImcColData' Result of Antispyware data to monitor(Successfully called: CheckRTPState : Time Taken:21.069)

i don't think they are taking too long,

and the below for HardDisk Encryption:

00351,09 2020/08/22 11:37:54.464 3 SYSTEM PulseSecureService.exe OpswatIMC p8436 t34C opshdencryptionclientv4.cpp:85 - 'OpswatImcColData' Result of HDEncryption API calls (Successfully called: FindInstalledProducts : Time Taken:70.589, Successfully called: GetProductVersion : Time Taken:57.5103, Successfully called: GetEncryptionState : Time Taken:770.898)

i noticed that sometimes it takes too long and sometimes working fastly 

may the internet connection  is the problem ? 

[flipPipe]

Hi @amjad.ra2,

From what you show, it is taking more or less 2 seconds, which is not so bad.

When in logs it shows

Time Taken:770.898

It means it took 0.770898 seconds to run.

So, the problem could be in other place, as [email protected] mentioned, so also check logs of AntiVirus and AntiSpyWare software.

Check all debuglog file (3rd column), and see where is taking more time, if needed, increase (just for testing) the logging to detailed.

Meanwhile, you should open a case in PS, because it can be a problem mixing all those tests.

Best Regards,

Flip

[[email protected]]

@amjad.ra2 Please open a support ticket with us. Pulse Client logs are stating the host checker evaluation is not consuming much time, hence this might require additional debugging.