Endpoint Server NWE - Why are files showing on zero 0 hosts

[Anonymous]

When reviewing the files in NWE there are 1000s of files that report as being on zero 0 hosts?

Can someone help me understand why that is and what can I do to remove them? If they are on no hosts then shouldn't they not be reporting upon?

This is an example of the most recently seen files on zero hosts

[JamesMoon]

Hi Jeremy,

"ON HOSTS" value changes based on verify_file command sent to the agent to verify if the file exists on it.

The files showing 0 count indicates that they were found by at least one agent before but removed since then.

If you happen to find any file that still exists but shows 0 "ON HOSTS", please let RSA Support know.

I can find some of the files that have 0 hostCount but it doesn't seem to find all files.

mongo admin -u deploy_admin

use endpoint-server

db.file.find({"hostCount":0}) 

We will provide further assistance from the case and will also update this page when we have further information. 

Thanks.