cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
ReallyWhy
Level 10
Report Inappropriate Content
Message 1 of 7

Multiple Windows 10 Event Log Errors with faulting module fcags.exe

I am seeing the event logs fill up on Windows 10 systems with the following errors:

Faulting application name: fcags.exe, version: 11.0.700.18, time stamp: 0x5bf3a399
Faulting module name: fcags.exe, version: 11.0.700.18, time stamp: 0x5bf3a399
Exception code: 0xc0000005
Fault offset: 0x00000000001e8a6d
Faulting process id: 0x57498
Faulting application start time: 0x01d5ad35b2f2d24c
Faulting application path: C:\Program Files\McAfee\DLP\Agent\fcags.exe
Faulting module path: C:\Program Files\McAfee\DLP\Agent\fcags.exe
Report Id: 0cf28c97-0b28-4eb2-99d2-0fb224351a0b
Faulting package full name:
Faulting package-relative application ID:

The errors are generated over and over every minute (and numerous machines have this issue).  Is this an actual problem with the DLP agent or is this just noise? 

Has anyone else seen this?  I am running ePO 5.10 with DLPe 11.0.700 and ENS 10.6.1.

I read through Data Loss Prevention 11.x.x Known Issues and found the following workaround for version 11.0.400 for a similiar issue.  However I do not see where to add the process name in the Windows Client configuration of DLP policy.  (Technical Articles ID: KB89301)

Issue: An error appears in the Windows 10 Event Viewer shows one or more of the following:
Faulting module name: fcagpph32.dll
Faulting module name: fcagpph64.dll
Faulting module name: fcagcbh32.dll
Faulting module name: fcagcbh64.dll
Workaround: Add the process name that appears in the event viewer error, to clipboard whitelisted processes in Windows Client configuration.

Help please!

6 Replies
ReallyWhy
Level 10
Report Inappropriate Content
Message 2 of 7

Re: Multiple Windows 10 Event Log Errors with faulting module fcags.exe

I submitted an SR with McAfee Support.  They advised since 11.0.700 is going end of life in March, I needed to upgrade to version 11.3 and see if the issue persists.  I upgraded two devices and so far the errors are no longer showing up in event viewer logs.  

ReallyWhy
Level 10
Report Inappropriate Content
Message 3 of 7

Re: Multiple Windows 10 Event Log Errors with faulting module fcags.exe

 
ReallyWhy
Level 10
Report Inappropriate Content
Message 4 of 7

Re: Multiple Windows 10 Event Log Errors with faulting module fcags.exe

After upgrading and rebooting device, still seeing application error in event viewer:
Log Name: Application
Source: Application Error
Date: 1/23/2020 6:32:03 AM
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: PC828725.corp.spiritaero.com
Description:
Faulting application name: fcags.exe, version: 11.3.2.8, time stamp: 0x5d39f02c
Faulting module name: fcags.exe, version: 11.3.2.8, time stamp: 0x5d39f02c
Exception code: 0xc0000005
Fault offset: 0x00000000001f65bd
Faulting process id: 0x3714
Faulting application start time: 0x01d5d1e8fd16001d
Faulting application path: C:\Program Files\McAfee\DLP\Agent\fcags.exe
Faulting module path: C:\Program Files\McAfee\DLP\Agent\fcags.exe
Report Id: ff3518dc-b802-4410-ad70-7dd962f82acb
Faulting package full name:
Faulting package-relative application ID:
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2020-01-23T12:32:03.543420000Z" />
<EventRecordID>64281</EventRecordID>
<Channel>Application</Channel>
<Computer>PC828725.corp.spiritaero.com</Computer>
<Security />
</System>
<EventData>
<Data>fcags.exe</Data>
<Data>11.3.2.8</Data>
<Data>5d39f02c</Data>
<Data>fcags.exe</Data>
<Data>11.3.2.8</Data>
<Data>5d39f02c</Data>
<Data>c0000005</Data>
<Data>00000000001f65bd</Data>
<Data>3714</Data>
<Data>01d5d1e8fd16001d</Data>
<Data>C:\Program Files\McAfee\DLP\Agent\fcags.exe</Data>
<Data>C:\Program Files\McAfee\DLP\Agent\fcags.exe</Data>
<Data>ff3518dc-b802-4410-ad70-7dd962f82acb</Data>
<Data>
</Data>
<Data>
</Data>
</EventData>
</Event>
jsubbura
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 5 of 7

Re: Multiple Windows 10 Event Log Errors with faulting module fcags.exe

Hi @ReallyWhy ,

Thank you for writing in here.

Application error ID 1000 means that DLP is getting crashed.

Is this a problem only on one machine? Windows version along with the build number?

Kindly make sure you have the exclusions set for DLP in ENS as per the article below,

https://kb.mcafee.com/corporate/index?page=content&id=KB68520

 

Then, make sure you have DLP access protection enabled, DLP watchdog services enabled in the DLP Windows Client Configuration policy.

 

If fcag.exe still crashes after performing the above, kindly make sure you enable debug logging for DLP and enabling dump creation for fcag.exe process using the windows client configuration policy. Make sure that you assign a separate windows client config policy with debug and dump enabled only to this machine.

The next time when fcag.exe crashed after assigning the debug policy, kindly collect the MER and submit to the SR for further troubleshooting from the Support Engineer.

 

 

Was my reply helpful?
If you find this post useful, Please give it a Kudos! Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!

Thank you

Regards,
Jithendran S
McAfee Employee
ReallyWhy
Level 10
Report Inappropriate Content
Message 6 of 7

Re: Multiple Windows 10 Event Log Errors with faulting module fcags.exe

This is a problem on numerous machines (every machine I have checked has the error in event viewer). Windows 10, 1709. The exclusions exist within the ENS policy for DLP processes and folder level exclusions. Created a new policy (duplicated company default), then assigned to one device. Modified the policy to enable DEBUG as advised. Still receiving application fault fcags.exe in event logs. Faulting application name: fcags.exe, version: 11.3.2.8, time stamp: 0x5d39f02c Faulting module name: fcags.exe, version: 11.3.2.8, time stamp: 0x5d39f02c Exception code: 0xc0000005 Fault offset: 0x00000000001f65bd Faulting process id: 0x3698 Rebooted system, ran MER, and uploaded to McAfee service request.
jsubbura
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 7 of 7

Re: Multiple Windows 10 Event Log Errors with faulting module fcags.exe

Hi @ReallyWhy ,

Thank you for the update. We would need to analyze the crash dumps for this fcag.exe which is getting crashed frequently to understand why its crashing. 

Let us wait for further update from Technical Support in here.

 

Thank you.

Regards,
Jithendran S
McAfee Employee
You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community