cancel
Showing results for 
Search instead for 
Did you mean: 
Remix
Level 7
Report Inappropriate Content
Message 11 of 20

Re: Query on mfetp.exe

Jump to solution

Hi,

I have the exact same issue on a single server (see the EndpointSecurityPlatform_errors.log entry below)

Was McAfee able to pinpoint what the issue is with this?

03/13/2019 03:59:37.779 PM    mfetp(4156.6972) <SYSTEM> exclusion.EXCLUSION.Error (exclusionbl.cpp:5334): Sending exclusion policy to AMCore failed. Task name: EXCLUSION_EXCLUDE_OAS_PROCESS_GROUP_DEFAULT, Error code: 0xA7F40511

03/13/2019 03:59:37.795 PM    mfetp(4156.6972) <SYSTEM> exclusion.EXCLUSION.Error (exclusionbl.cpp:5128): Failed to set property :

03/13/2019 03:59:37.796 PM    mfetp(4156.6972) <SYSTEM> exclusion.EXCLUSION.Error (exclusionbl.cpp:4792): AMCore error code: 0xA7F40511

03/13/2019 03:59:37.798 PM    mfetp(4156.10968) <SYSTEM> MaSpb.MaSpb.Error (lpc_EnforcePolicies.cpp:1449): SetFileExclusion: Failed to set exclusion task settings. TaskName = EXCLUDE_OAS_PROCESS_GROUP_DEFAULT, Error Code = xc0350025

Re: Query on mfetp.exe

Jump to solution

Hi, 

Advice provided by McAfee was to upgrade February 2019 release ENS 10.6.1.1206 and Threat Prevention 10.6.1.1273 

Re: Query on mfetp.exe

Jump to solution

Support is suggesting it's an OS issue for us.
Though we are seeing HIGH disk utilization. 

Odd. 

BN-Rob
Level 7
Report Inappropriate Content
Message 14 of 20

Re: Query on mfetp.exe

Jump to solution

Hello,

since 2 weeks we have the same problem. some clients is mcafee not repsonding. in the error we can see:

05/09/2019 02:03:42.043 PM mfeesp(3848.8256) <SYSTEM> LPC.CommonLPC.Error (common_policy_enforcement.cpp:1865): ENSGlobalExclusion: Error: Delete policy failed with error 87

05/09/2019 02:03:42.082 PM mfeesp(3848.8256) <SYSTEM> LPC.CommonLPC.Error (common_policy_enforcement.cpp:1479): Failed to set policies for telemetry, -2147483391
05/09/2019 02:04:57.251 PM mfetp(3512.4908) <SYSTEM> oasbl.OAS.Error (oasbl.cpp:1626): AVPolicyBeginUpdate(&hUpdate) failed: 0x6be
05/09/2019 02:04:57.254 PM mfetp(3512.4908) <SYSTEM> oasbl.OAS.Error (oasbl.cpp:1820): Failed to refresh AMCore GTI proxy settings
05/09/2019 02:04:57.252 PM mfetp(3512.4896) <SYSTEM> oasbl.OAS.Error (oasbl.cpp:1626): AVPolicyBeginUpdate(&hUpdate) failed: 0x6be
05/09/2019 02:04:57.267 PM mfetp(3512.4896) <SYSTEM> oasbl.OAS.Error (oasbl.cpp:1820): Failed to refresh AMCore GTI proxy settings
05/09/2019 02:04:57.252 PM mfetp(3512.4892) <SYSTEM> oasbl.OAS.Error (oasbl.cpp:1626): AVPolicyBeginUpdate(&hUpdate) failed: 0x6be
05/09/2019 02:04:57.269 PM mfetp(3512.4892) <SYSTEM> oasbl.OAS.Error (oasbl.cpp:1820): Failed to refresh AMCore GTI proxy settings
05/09/2019 02:04:57.252 PM mfetp(3512.4912) <SYSTEM> oasbl.OAS.Error (oasbl.cpp:1626): AVPolicyBeginUpdate(&hUpdate) failed: 0x6be
05/09/2019 02:04:57.252 PM mfetp(3512.4904) <SYSTEM> oasbl.OAS.Error (oasbl.cpp:1626): AVPolicyBeginUpdate(&hUpdate) failed: 0x6be
05/09/2019 02:04:57.270 PM mfetp(3512.4912) <SYSTEM> oasbl.OAS.Error (oasbl.cpp:1820): Failed to refresh AMCore GTI proxy settings
05/09/2019 02:04:57.270 PM mfetp(3512.4904) <SYSTEM> oasbl.OAS.Error (oasbl.cpp:1820): Failed to refresh AMCore GTI proxy settings
05/09/2019 02:04:57.273 PM mfetp(3512.4632) <SYSTEM> oasbl.OAS.Error (oasbl.cpp:2258): StateChangeEventCallback: AVS_INITIALIZE_FAILED or AVS_CRASH or AVS_CORRUPT_CONTENT, state = 0 : calling UpdateWACState(WAC_OAS_DISABLE)
05/09/2019 02:04:57.287 PM mfetp(3512.4912) <SYSTEM> oasbl.OAS.Error (oasbl.cpp:1626): AVPolicyBeginUpdate(&hUpdate) failed: 0x6ef
05/09/2019 02:04:57.288 PM mfetp(3512.4912) <SYSTEM> oasbl.OAS.Error (oasbl.cpp:1820): Failed to refresh AMCore GTI proxy settings
05/09/2019 02:04:57.902 PM mfetp(3512.4896) <SYSTEM> oasbl.OAS.Error (oasbl.cpp:1626): AVPolicyBeginUpdate(&hUpdate) failed: 0x6ef
05/09/2019 02:04:57.902 PM mfetp(3512.4896) <SYSTEM> oasbl.OAS.Error (oasbl.cpp:1820): Failed to refresh AMCore GTI proxy settings
05/09/2019 02:04:57.931 PM mfetp(3512.4904) <SYSTEM> oasbl.OAS.Error (oasbl.cpp:1626): AVPolicyBeginUpdate(&hUpdate) failed: 0x6ef
05/09/2019 02:04:57.932 PM mfetp(3512.4904) <SYSTEM> oasbl.OAS.Error (oasbl.cpp:1820): Failed to refresh AMCore GTI proxy settings
05/09/2019 02:06:37.880 PM McTray(4660.4196) <frickes> McTray.McTrayUPC.Error (TechnologyTopicHandler.cpp:150): CheckTechnologyState failed to get technology status from BO: ATP, error: 80000002L
05/09/2019 02:06:37.881 PM McTray(4660.4196) <frickes> McTray.McTrayUPC.Error (TechnologyTopicHandler.cpp:213): Adaptiver Bedrohungsschutz is not responding.
05/09/2019 02:07:37.947 PM McTray(4660.4196) <frickes> McTray.McTrayUPC.Error (TechnologyTopicHandler.cpp:150): CheckTechnologyState failed to get technology status from BO: ATP, error: 80000002L
05/09/2019 02:07:37.948 PM McTray(4660.4196) <frickes> McTray.McTrayUPC.Error (TechnologyTopicHandler.cpp:213): Adaptiver Bedrohungsschutz is not responding.
05/09/2019 02:08:37.979 PM McTray(4660.4196) <frickes> McTray.McTrayUPC.Error (TechnologyTopicHandler.cpp:150): CheckTechnologyState failed to get technology status from BO: ATP, error: 80000002L
05/09/2019 02:08:37.980 PM McTray(4660.4196) <frickes> McTray.McTrayUPC.Error (TechnologyTopicHandler.cpp:213): Adaptiver Bedrohungsschutz is not responding.
05/09/2019 02:09:38.008 PM McTray(4660.4196) <frickes> McTray.McTrayUPC.Error (TechnologyTopicHandler.cpp:150): CheckTechnologyState failed to get technology status from BO: ATP, error: 80000002L
05/09/2019 02:09:38.009 PM McTray(4660.4196) <frickes> McTray.McTrayUPC.Error (TechnologyTopicHandler.cpp:213): Adaptiver Bedrohungsschutz is not responding.
05/09/2019 02:12:52.843 PM mfeesp(3848.7560) <SYSTEM> LPC.CommonLPC.Error (common_policy_enforcement.cpp:1865): ENSGlobalExclusion: Error: Delete policy failed with error 87

05/09/2019 02:12:52.878 PM mfeesp(3848.7560) <SYSTEM> LPC.CommonLPC.Error (common_policy_enforcement.cpp:1479): Failed to set policies for telemetry, -2147483391
05/09/2019 02:26:08.344 PM mfeesp(3848.8256) <SYSTEM> LPC.CommonLPC.Error (common_prop_collection.cpp:373): RegQueryValueEx for bGlobExclConfigured failed with error: 2

Actual config:

Agent 5.6.0.702
Endpoint Security Platform 10.6.1.1206
Endpoint Security Threat Prevention 10.6.1.1273

On most clients a reinstall helps but on some comes back after 2-3 days again. Have you an idea what can be the problem? We downgrade from Agent 5.6.0.878 to agent 5.6.0.702. But problem exist agian.

Help it to downgrade to last agent version 5.5 or must we downgrade also to platform version 10.5?

 

We have also not found a ePO query to find out the "bad" systems. We can only react when user is calling us.

 

regards
Robert

 

 

 

 

 

Highlighted

Re: Query on mfetp.exe

Jump to solution
Hi BN-Bob,

Might be a good idea to check if there is a memory leak on mfept.exe process, as can see the memory is increasing of some devices with ENS 10.6.1.1124 and TP 10.6.1.1208. The advice was to roll out hotifx 190212 which is meant to resolve a memory leak with mfeAtp.exe but devices with the February Hotfix 190212 applied don't seem to have having issues.

If you are using the agent 5.6.0.878 it is best to remove this from your EPO and downgrade any client that has this agent installed.

Re: Query on mfetp.exe

Jump to solution

What issues are you seeing BN-Bob? Can you see the mfetp.exe process is consuming alot of memory?

BN-Rob
Level 7
Report Inappropriate Content
Message 17 of 20

Re: Query on mfetp.exe

Jump to solution

Hi,

when we look to taskmanager you can not see any unnormal memory usage or cpu and disk usage.

I have also opened a SR (4-19901180411) but we heard since a week nothing from the support.

The Hotfix is applied on the machines.

 

 

McAfee Employee chealey
McAfee Employee
Report Inappropriate Content
Message 18 of 20

Re: Query on mfetp.exe

Jump to solution

Hi Robert, I have just checked your service request and your case is already raised with our engineering time. Dependant on what needs to be done from our engineering side this can sometimes take longer. Based on the comments that our developers have left after reviewing the data, It would seem that this requires some code changes rather than configuration changes. The assigned technical owner of the case will be in contact with you as soon as there are any further updates from the engineering team.

Was my reply helpful?
If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

Re: Query on mfetp.exe

Jump to solution
Hi BN-Bob

What I am seeing is that the mfetp.exe reaches a certain threshold and then crashes at some point which can be seen in the application logs of the event viewer

Re: Query on mfetp.exe

Jump to solution

We too ran the Hotfix. The issue occurred but seemed to release within 10-15 seconds.
Then things proceeded normally.

Again, we were told some logs showed it to be an OS issue.
Still odd, because the user can open and close the folders normally when Mcafee is not installed. 

We may re-image or replace the machine rather than continuing to dig, as the user is up for a re-fressh soon. 

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community