Automatic Grouping does not work

|
  • 54
  • 0

Issue Description

User feedback that configured Automatic Grouping on ES Manager but the Endpoints are not moved to the Group automatically.

Handling Process

1. Check the configurations of 'Auto Grouping'. The IP address must be an IP range/subnets.

2. Check the agent installation time and agent last online time, because the agent only matches the automatic group policy when it appears on the ES manager for the first time.

3. Check and compare the time of configuring the Automatic Group and the time of agent appears online on ES Manager.

Root Cause

Cause 1: IP address does not contain a range / subnet.

Cause 2:
The endpoint already appears online before the 'Automatic Grouping' is configured.

Solution

1. Manually move the endpoints into the specific Groups.
2. Uninstall the agent on the endpoint and install again. Make sure the group is already created and configured before installing the agent.

Suggestions

The automatic grouping only applies to the endpoint that has installed agent after creating the group. Not applicable to existing online endpoints.

I want to write a case
Doc ID: 8775
Author: Siva
Updated: 2023-08-01 21:04
Version: