Skip navigation
McAfee Secure sites help keep you safe from identity theft, credit card fraud, spyware, spam, viruses and online scams
10844 Views 24 Replies Latest reply: Mar 22, 2012 7:21 AM by Minkus RSS Go to original post 1 2 3 Previous Next
  • Minkus Newcomer 28 posts since
    Feb 18, 2009
    Currently Being Moderated
    10. Dec 6, 2011 4:50 AM (in response to samd)
    Re: 8.8 patch 1 killed my Microsoft cluster...

    Received this from McAfee just now. I shall be contacting Microsoft to get the fix shortly - kudos to McAfee if this wasn't their fault!

     

    After our development team analyzed all the data and weighted the options these are the conclusions of the investigation:

     

    Solution

    Microsoft has confirmed that a Cluster (Windows 2008 R2) will put a Cluster Server Volume (CSV) in redirected mode if a filter’s Altitude is not an integer.

     

    Contact Microsoft to obtain a fix to address this issue.

     

    Workaround

    Install a version of VSE that has not adopted the new drivers, for example:

     

    VSE 8.7 Patch 4 or below

    VSE 8.8

     

    This has been documented in our knowledge base under KB73596.

     

    Please let me know if you have any questions or if you can confirm we can now close this support case.

  • Minkus Newcomer 28 posts since
    Feb 18, 2009
    Currently Being Moderated
    12. Dec 8, 2011 5:50 AM (in response to samd)
    Re: 8.8 patch 1 killed my Microsoft cluster...

    Have contacted Microsoft and opened a case - they are aware of the issue & are working on a fix to resolve it.

     

    Only suggestion at the moment is to roll back to the previous patch level & wait for the fix to be released.

     

    Will post here when I hear from them again. Got the impression it might be a while due to Microsoft's usual extensive testing regime etc... but it will happen.

  • Minkus Newcomer 28 posts since
    Feb 18, 2009
    Currently Being Moderated
    13. Dec 8, 2011 5:50 AM (in response to Minkus)
    Re: 8.8 patch 1 killed my Microsoft cluster...

    P.S. No, it's not fixed in R2 SP1 - have been running this for ages.

  • marcphilips Newcomer 1 posts since
    Dec 15, 2011
    Currently Being Moderated
    16. Dec 15, 2011 8:11 AM (in response to Minkus)
    Re: 8.8 patch 1 killed my Microsoft cluster...

    Hi Minkus

    Can you give me your MS case ID so I can have our TAM attach ours and some others customers so we can so more psuh on getting the solution implemetented.

    Thanks

  • Minkus Newcomer 28 posts since
    Feb 18, 2009
    Currently Being Moderated
    17. Dec 15, 2011 9:55 AM (in response to marcphilips)
    Re: 8.8 patch 1 killed my Microsoft cluster...

    Hi,


    My case ID is 111120644043954

     

    Kind regards,

    Chris

  • Minkus Newcomer 28 posts since
    Feb 18, 2009
    Currently Being Moderated
    18. Feb 10, 2012 10:15 AM (in response to Minkus)
    Re: 8.8 patch 1 killed my Microsoft cluster...

    Hi,

     

    Found this Microsoft blog post today. The part at the end sounds promising...

     

    There is an issue with Cluster Shared Volumes and McAfee VirusScan Enterprise that I wanted to pass along.  When installing McAfee VSE 8.7 Patch 5 or 8.8 Patch 1, the CSV drives will go into redirected mode and will not go out of it.

    The reason for this is that the McAfee filter driver (mfehidk.sys) is using decimal points in the altitude to help in identifying upgrade scenarios for their product.  The Cluster CSV filter only accepts whole numbers and puts the drives in redirected access mode when it sees this decimal value.

    When seeing this, if you run FLTMC from an administrative command prompt, you may see something similar too:

    C:\> fltmc

    Filter Name    Num Instances      Altitude    Frame
    ------------------------------------------------------
    CSVFilter            2            404900        0
    mfehidk                           329998.99   <Legacy>
    mfehidk              2            321300.00     0

    If you were to generate a Cluster Log, you would see the below identifying that it cannot read the altitude value properly.

    INFO [DCM] FsFilterCanUseDirectIO is called for \\?\Volume{188c44f1-9cd0-11df-926b-a4ca2baf36ff}\
    ERR  mscs::FilterSnooper::CanUseDirectIO: BadFormat(5917)' because of 'non-digit found'
    INFO [DCM] PostOnline. CanUseDirectIO for C2V1 => false

    McAfee has released the following document giving a temporary workaround.

    Cluster Shared Volumes (CSV) status becomes Online (Redirected access)
    https://kc.mcafee.com/corporate/index?page=content&id=KB73596

    Microsoft is aware of the problem and currently working on a fix.  When this fix is available, this will be updated and a new KB Article will be created with the fix.

    John Marlin
    Senior Support Escalation Engineer
    Microsoft Enterprise Platforms Support

More Like This

  • Retrieving data ...

Bookmarked By (0)

Legend

  • Correct Answers - 5 points
  • Helpful Answers - 3 points