Hello Cristian, can you put the log of pfqueue in TRACE and retry , you will have more debug to understand what happen.
Edit conf/log/conf.d/pfqueue.conf ### pfqueue logger ### log4perl.rootLogger = TRACE, QUEUE_SYSLOG Regards Fabrice Le 2017-08-07 à 09:23, Cristian Mammoli via PacketFence-users a écrit : > Hi, this is pretty trivial I think but I didn't find a way to make it > work. > I want to trigger a violation when a client has no antivirus > installed, i configured a wmi rule like this: > > [custom_Antivirus] > request=select * from AntiVirusProduct > namespace=ROOT\SecurityCenter2 > action= <<EOT > [AntivirusPresent] > attribute = displayName > operator = match > value = * > > [1:!AntivirusPresent] > action=trigger_violation > action_param = mac = $mac, tid = 100002, type = INTERNAL > EOT > on_tab=1 > > But it does not work, I think the problem is that the query does not > return any result and I get inthe logs: > > pfqueue(7319) ERROR: [mac:20:cf:30:36:7c:bb] No WMI header given in > string '' (pf::scan::wmi::rules::parseResult) > > > ------------------------------------------------------------------------------ > > Check out the vibrant tech community on one of the world's most > engaging tech sites, Slashdot.org! http://sdm.link/slashdot > _______________________________________________ > PacketFence-users mailing list > PacketFence-users@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/packetfence-users -- Fabrice Durand fdur...@inverse.ca :: +1.514.447.4918 (x135) :: www.inverse.ca Inverse inc. :: Leaders behind SOGo (http://www.sogo.nu) and PacketFence (http://packetfence.org) ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot _______________________________________________ PacketFence-users mailing list PacketFence-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/packetfence-users
