this is very strange. I just compared process execution and external parameter handling code in 3.9 and 4.1 and the only difference is that in 4.x agent replaces null characters with spaces in received command output. Theoretically if script returns null character in first line that could cause such difference in behavior.

Best regards,
Victor

we have tried another command, which also generate an empty line in the first output line.

Thanks for your workaround - it works great!

It would be nice if the behaviour was the same as in the previous versions.

best regards,
Alwin

Thursday, July 28, 2022 1:01:30 PM

Not sure if in previous versions agent was skipping empty lines, but currently it just takes the contents of the first line, which is emtpy.
Please try it e.g. this way:
ExternalParameter = DefenderEngineLastUpdate:powershell -Command "& Get-MpComputerStatus | Select -ExpandProperty AntivirusSignatureLastUpdated | Write-Host"

the current Server an Agent version is: 4.1.404

The command needs 34ms to execute. In the agent configuration we have also added the line "ExternalParameterProviderTimeout = 60"

We try it with the following command (is this the correct syntax?)

ExternalParameterShellExec = DefenderEngineLastUpdate:powershell -Command "& {Get-MpComputerStatus | Select -ExpandProperty AntivirusSignatureLastUpdated}"

We added also the following parameters to the agent configuration file:

SubAgent = wineventsync.nsm
DebugTags=winsyncevent:6

Now we have logs in the windows event log but no entrys for the executed external parameters.

best regards,
Alwin

try to use ExternalParameterShellExec instead. Also, how long it take to execute this command? There could have been changes in handling execution timeouts. Agent log on debug level 6 could be helpful as well.

And what version you are using currently?

Best regards,
Victor