Within the SOLIDCORE.LOG, is this normal behavior for files to be repetitively removed and then added back immediately? I see this in the Solidcore.log repetitively, every 5 min the same files are removed & added back.
SYSTEM: cmdi_process.c: 505: Command 'sadmin attr remove -a "\Program Files\PPSG\PSISoftwareLicense.dll"' returned 0: No error
SYSTEM: cmdi_process.c: 505: Command 'sadmin attr add -a "\Program Files\PPSG\PSISoftwareLicense.dll"' returned 0: No error
This looks like McAfee Agent have policy enforcement interval of 5 minutes. What might be happening is the policy interval duration is too short. The new policy enforce kickoff before the policy completely apply. This in turns will remove current rules and start applying rules from the beginning.
Thanks for the response.
That sounds realistic. Is there a Best Practice or recommenced interval it should be set at? This setting was in place before I took over Application Control.
I could set it it to higher. We have our machines check in once every hour, should this apply policy be set to the same or is there a reason to keep it shorter?
I recall earlier MA versions have enforcement interval set at 5 minutes as the default. The later versions were changed to 60 minutes as the default. I suggest starting with default values and monitor logs. There are no Best Practice Guide I can find for McAfee Agent.