VirusScan 8.7 Patch 2, epo agent 4.5, computers with 1 GB memory, DAT updates fail

[bburwell]

About one quarter of my organization's PCs have just 1 GB of memory. They are running VirusScan 8.7 P2 and we have a 4.5 epo server. The pcs have epo 4.5 agent without any patches. I hadn't done the patch 1 for agent 4.5 because it seemed like there were some scary bugs introduced but I do see that a memory leak problem was fixed.

Starting a few weeks ago, the occasional PC with 1 GB of memory gets generic script error when getting a new DAT file. I try remotely restarting Framework service and the various mcafee services but typically it takes a reboot to get the antivirus definition update to work.

I looked up generic script error in the Mcafee database and didn't see anything relevant.

Any suggestions?

Here's the agent log when it fails.

2010-09-07 10:05:00    I    #256    Manage    Running task SoftwareID:EPOAGENT3000, TaskID:22
2010-09-07 10:05:00    I    #4064    FrmSvc    User SID is S-1-5-18 and SessionID is 0
2010-09-07 10:05:00    I    #4064    UpdEvents    Initializing Event Interface
2010-09-07 10:05:00    I    #4064    UpdEvents    EpoEventInf Interface: Initialization succeeded.
2010-09-07 10:05:00    I    #4044    Uec    Waiting for ipc thread to initialize
2010-09-07 10:05:00    I    #2728    ipcchannel    Initializing IPC server
2010-09-07 10:05:00    I    #2728    Uec    Initialized ipc channel successfully
2010-09-07 10:05:00    I    #4044    Uec    Ipc thread initialized successfully
2010-09-07 10:05:00    I    #4044    Uec    Invoking Mue with "C:\Program Files\McAfee\Common Framework\McScript_InUse.exe"  -script "C:\Documents and Settings\All Users\Application Data\McAfee\Common Framework\UpdateMain.McS" -id 8889 -localeid 0409 -parent FRAMEWORK -logfile "C:\Documents and Settings\All Users\Application Data\McAfee\Common Framework\DB\McScript" -initiator 1 -ipcid "\\.\pipe\upda04044" -installdir "C:\Program Files\McAfee\Common Framework"
2010-09-07 10:05:00    I    #4064    updater    UpdateTask update session for initiator EPOAGENT3000 started
2010-09-07 10:05:00    I    #256    Sched    <<--RunTask
2010-09-07 10:05:00    I    #1952    Sched    Product update - Last run time(local) is Tue Sep 07 10:05:00 2010
2010-09-07 10:05:00    I    #1952    Sched   
2010-09-07 10:05:00    I    #1952    Sched    CNaiSchedule::GetRandomizedDelayMins() : 22
2010-09-07 10:05:00    i    #1952    Sched    Next time(local) of task Product update: Tuesday, September 07, 2010 11:23:00 AM
2010-09-07 10:05:00    I    #1952    Sched    End of invoking the task
2010-09-07 10:05:00    I    #1948    Sched    The task Product update is still running
2010-09-07 10:05:01    I    #2728    Uec    Received ipc data from mue
2010-09-07 10:05:01    I    #2728    Uec    Processing progress information
2010-09-07 10:05:01    i    #2728    Updater    Checking update packages from repository ePO_ROCKY.
2010-09-07 10:05:01    I    #2728    Uec    Done processing progress information
2010-09-07 10:05:01    I    #2728    Uec    Received ipc data from mue
2010-09-07 10:05:01    I    #2728    Uec    Processing progress information
2010-09-07 10:05:01    i    #2728    Updater    Initializing update...
2010-09-07 10:05:01    I    #2728    Uec    Done processing progress information
2010-09-07 10:05:01    I    #2728    Uec    Received ipc data from mue
2010-09-07 10:05:01    I    #2728    Uec    Processing progress information
2010-09-07 10:05:01    i    #2728    Updater    Verifying catalog.z.
2010-09-07 10:05:01    I    #2728    Uec    Done processing progress information
2010-09-07 10:05:01    I    #2728    Uec    Received ipc data from mue
2010-09-07 10:05:01    I    #2728    Uec    Processing progress information
2010-09-07 10:05:01    i    #2728    Updater    Extracting catalog.z.
2010-09-07 10:05:01    I    #2728    Uec    Done processing progress information
2010-09-07 10:05:01    I    #2728    Uec    Received ipc data from mue
2010-09-07 10:05:01    I    #2728    Uec    Processing progress information
2010-09-07 10:05:01    i    #2728    Updater    Loading update configuration from: catalog.xml
2010-09-07 10:05:01    I    #2728    Uec    Done processing progress information
2010-09-07 10:05:02    I    #2728    Uec    Received ipc data from mue
2010-09-07 10:05:02    I    #2728    Uec    Processing progress information
2010-09-07 10:05:02    i    #2728    Updater    These updates will be applied if they are in the repository:  Engine, DAT, EXTRADAT1000, VIRUSCAN8700.
2010-09-07 10:05:02    I    #2728    Uec    Done processing progress information
2010-09-07 10:05:02    I    #2728    Uec    Received ipc data from mue
2010-09-07 10:05:02    I    #2728    Uec    Processing progress information
2010-09-07 10:05:02    i    #2728    Updater    Downloading PkgCatalog.z.
2010-09-07 10:05:02    I    #2728    Uec    Done processing progress information
2010-09-07 10:05:02    I    #2728    Uec    Received ipc data from mue
2010-09-07 10:05:02    I    #2728    Uec    Processing progress information
2010-09-07 10:05:02    i    #2728    Updater    Verifying PkgCatalog.z.
2010-09-07 10:05:02    I    #2728    Uec    Done processing progress information
2010-09-07 10:05:02    I    #2728    Uec    Received ipc data from mue
2010-09-07 10:05:02    I    #2728    Uec    Processing progress information
2010-09-07 10:05:02    i    #2728    Updater    Extracting PkgCatalog.z.
2010-09-07 10:05:02    I    #2728    Uec    Done processing progress information
2010-09-07 10:05:03    I    #2728    Uec    Received ipc data from mue
2010-09-07 10:05:03    I    #2728    Uec    Processing progress information
2010-09-07 10:05:03    i    #2728    Updater    Loading update configuration from: PkgCatalog.xml
2010-09-07 10:05:03    I    #2728    Uec    Done processing progress information
2010-09-07 10:05:04    I    #2728    Uec    Received ipc data from mue
2010-09-07 10:05:04    I    #2728    Uec    Processing progress information
2010-09-07 10:05:04    i    #2728    Updater    Verifying V2engdet.mcs.
2010-09-07 10:05:04    I    #2728    Uec    Done processing progress information
2010-09-07 10:05:04    I    #2728    Uec    Received ipc data from mue
2010-09-07 10:05:04    I    #2728    Uec    Processing progress information
2010-09-07 10:05:04    i    #2728    Updater    Product(s) running the latest Engine.
2010-09-07 10:05:04    I    #2728    Uec    Done processing progress information
2010-09-07 10:05:04    I    #2728    Uec    Received ipc data from mue
2010-09-07 10:05:04    I    #2728    Uec    Processing progress information
2010-09-07 10:05:04    i    #2728    Updater    Downloading PkgCatalog.z.
2010-09-07 10:05:04    I    #2728    Uec    Done processing progress information
2010-09-07 10:05:04    I    #2728    Uec    Received ipc data from mue
2010-09-07 10:05:04    I    #2728    Uec    Processing progress information
2010-09-07 10:05:04    i    #2728    Updater    Verifying PkgCatalog.z.
2010-09-07 10:05:04    I    #2728    Uec    Done processing progress information
2010-09-07 10:05:04    I    #2728    Uec    Received ipc data from mue
2010-09-07 10:05:04    I    #2728    Uec    Processing progress information
2010-09-07 10:05:04    i    #2728    Updater    Extracting PkgCatalog.z.
2010-09-07 10:05:04    I    #2728    Uec    Done processing progress information
2010-09-07 10:05:04    I    #2728    Uec    Received ipc data from mue
2010-09-07 10:05:04    I    #2728    Uec    Processing progress information
2010-09-07 10:05:04    i    #2728    Updater    Loading update configuration from: PkgCatalog.xml
2010-09-07 10:05:04    I    #2728    Uec    Done processing progress information
2010-09-07 10:05:05    I    #2728    Uec    Received ipc data from mue
2010-09-07 10:05:05    I    #2728    Uec    Processing progress information
2010-09-07 10:05:05    i    #2728    Updater    Verifying V2datdet.mcs.
2010-09-07 10:05:05    I    #2728    Uec    Done processing progress information
2010-09-07 10:05:05    I    #2728    Uec    Received ipc data from mue
2010-09-07 10:05:05    I    #2728    Uec    Processing progress information
2010-09-07 10:05:05    i    #2728    Updater    Downloading PkgCatalog.z.
2010-09-07 10:05:05    I    #2728    Uec    Done processing progress information
2010-09-07 10:05:05    I    #2728    Uec    Received ipc data from mue
2010-09-07 10:05:05    I    #2728    Uec    Processing progress information
2010-09-07 10:05:05    i    #2728    Updater    Verifying PkgCatalog.z.
2010-09-07 10:05:05    I    #2728    Uec    Done processing progress information
2010-09-07 10:05:05    I    #2728    Uec    Received ipc data from mue
2010-09-07 10:05:05    I    #2728    Uec    Processing progress information
2010-09-07 10:05:05    i    #2728    Updater    Extracting PkgCatalog.z.
2010-09-07 10:05:05    I    #2728    Uec    Done processing progress information
2010-09-07 10:05:05    I    #2728    Uec    Received ipc data from mue
2010-09-07 10:05:05    I    #2728    Uec    Processing progress information
2010-09-07 10:05:05    i    #2728    Updater    Loading update configuration from: PkgCatalog.xml
2010-09-07 10:05:05    I    #2728    Uec    Done processing progress information
2010-09-07 10:05:06    I    #2728    Uec    Received ipc data from mue
2010-09-07 10:05:06    I    #2728    Uec    Processing progress information
2010-09-07 10:05:06    i    #2728    Updater    Starting DAT update.
2010-09-07 10:05:06    I    #2728    Uec    Done processing progress information
2010-09-07 10:05:07    I    #2728    Uec    Received ipc data from mue
2010-09-07 10:05:07    I    #2728    Uec    Processing progress information
2010-09-07 10:05:07    i    #2728    Updater    Downloading DAT.
2010-09-07 10:05:07    I    #2728    Uec    Done processing progress information
2010-09-07 10:05:09    I    #2728    Uec    Received ipc data from mue
2010-09-07 10:05:09    I    #2728    Uec    Processing progress information
2010-09-07 10:05:09    i    #2728    Updater    Downloading avvdat-6098.zip.
2010-09-07 10:05:09    I    #2728    Uec    Done processing progress information
2010-09-07 10:07:19    I    #2728    Uec    Received ipc data from mue
2010-09-07 10:07:19    I    #2728    Uec    Processing progress information
2010-09-07 10:07:19    i    #2728    Updater    Backing up file(s) Engine DAT
2010-09-07 10:07:19    I    #2728    Uec    Done processing progress information
2010-09-07 10:08:37    I    #2728    Uec    Received ipc data from mue
2010-09-07 10:08:37    I    #2728    Uec    Processing progress information
2010-09-07 10:08:37    i    #2728    Updater    Pre-notifying for DAT update.
2010-09-07 10:08:37    I    #2728    Uec    Done processing progress information
2010-09-07 10:08:37    I    #2728    Uec    Received ipc data from mue
2010-09-07 10:08:37    I    #2728    Uec    Processing progress information
2010-09-07 10:08:37    i    #2728    Updater    Copying DAT.
2010-09-07 10:08:37    I    #2728    Uec    Done processing progress information
2010-09-07 10:08:40    I    #2728    Uec    Received ipc data from mue
2010-09-07 10:08:40    I    #2728    Uec    Processing progress information
2010-09-07 10:08:40    i    #2728    Updater    Generic script error.
2010-09-07 10:08:40    I    #2728    Uec    Done processing progress information
2010-09-07 10:08:42    I    #2728    Uec    Received ipc data from mue
2010-09-07 10:08:42    I    #2728    Uec    Processing progress information
2010-09-07 10:08:42    i    #2728    Updater    Verifying extradat.mcs.
2010-09-07 10:08:42    I    #2728    Uec    Done processing progress information
2010-09-07 10:08:45    I    #2728    Uec    Received ipc data from mue
2010-09-07 10:08:45    I    #2728    Uec    Processing progress information
2010-09-07 10:08:45    i    #2728    Updater    Product(s) running the latest ExtraDAT.
2010-09-07 10:08:45    I    #2728    Uec    Done processing progress information
2010-09-07 10:08:45    I    #2728    Uec    Received ipc data from mue
2010-09-07 10:08:45    I    #2728    Uec    Processing progress information
2010-09-07 10:08:45    i    #2728    Updater    Verifying VSE870Det.McS.
2010-09-07 10:08:45    I    #2728    Uec    Done processing progress information
2010-09-07 10:08:45    I    #2728    Uec    Received ipc data from mue
2010-09-07 10:08:45    I    #2728    Uec    Processing progress information
2010-09-07 10:08:45    i    #2728    Updater    Searching available updates for McAfee VirusScan Enterprise 8.7.0.
2010-09-07 10:08:45    I    #2728    Uec    Done processing progress information
2010-09-07 10:08:46    I    #2728    Uec    Received ipc data from mue
2010-09-07 10:08:46    I    #2728    Uec    Processing progress information
2010-09-07 10:08:46    i    #2728    Updater    Product(s) running the latest HotFix 517265.
2010-09-07 10:08:46    I    #2728    Uec    Done processing progress information
2010-09-07 10:08:46    I    #2728    Uec    Received ipc data from mue
2010-09-07 10:08:46    I    #2728    Uec    Processing progress information
2010-09-07 10:08:46    i    #2728    Updater    Product(s) running the latest HotFix 2.
2010-09-07 10:08:46    I    #2728    Uec    Done processing progress information
2010-09-07 10:08:46    I    #2728    Uec    Received ipc data from mue
2010-09-07 10:08:46    I    #2728    Uec    Processing progress information
2010-09-07 10:08:46    i    #2728    Updater    Update Finished
2010-09-07 10:08:46    I    #2728    Uec    Done processing progress information
2010-09-07 10:08:46    I    #2728    Uec    Received ipc data from mue
2010-09-07 10:08:46    I    #2728    Uec    Processing   EndUpdateDialog information
2010-09-07 10:08:46    I    #2728    Uec    Done processing  EndUpdateDialog information
2010-09-07 10:08:46    I    #2728    Uec    Received ipc data from mue
2010-09-07 10:08:46    I    #2728    Uec    Processing   EndUpdateDialog information
2010-09-07 10:08:46    I    #2728    Uec    Done processing  EndUpdateDialog information
2010-09-07 10:08:46    I    #2728    Uec    Received ipc data from mue
2010-09-07 10:08:46    I    #2728    Uec    Processing event information
2010-09-07 10:08:46    I    #2728    muemsg    Calling HandlePostpone with TaskID:  UpdateState: 1
2010-09-07 10:08:46    I    #2728    muemsg    Calling m_pUpdateInfoCallback->HandlePostpone
2010-09-07 10:08:46    I    #2728    Updater    CMcAfeeUpdate::HandlePostpone() Entered taskid: 22
2010-09-07 10:08:46    I    #2728    Updater    Finished calling GetPostponeMins
2010-09-07 10:08:46    I    #2728    Updater    CMcAfeeUpdate::HandlePostpone() Exit
2010-09-07 10:08:46    I    #2728    muemsg    Finished Calling m_pUpdateInfoCallback->HandlePostpone
2010-09-07 10:08:46    I    #2728    muemsg    Finished Calling HandlePostpone
2010-09-07 10:08:46    I    #2728    UpdEvents    DeInitializing Event Interface
2010-09-07 10:08:46    I    #2728    UpdEvents    EpoEventInf Interface: Deinitialization succeeded.
2010-09-07 10:08:46    I    #2728    muemsg    Updater session finish state value =1
2010-09-07 10:08:46    I    #2728    Uec    Done processing event  information
2010-09-07 10:08:46    I    #2728    Uec    Terminating thread
2010-09-07 10:08:46    I    #4044    Uec    Terminating ipc channel
2010-09-07 10:08:46    I    #4044    ipcchannel    Aborting IPC object connection
2010-09-07 10:08:46    I    #4044    ipcchannel    Closing IPC connection
2010-09-07 10:08:46    I    #588    FrmSvc    User SID is S-1-5-18 and SessionID is 0
2010-09-07 10:08:46    i    #1948    Sched    The task Product update is successful
2010-09-07 10:08:46    i    #1948    Sched    Scheduler: Task [Product update] is finished
2010-09-07 10:08:46    I    #1948    Sched    >>--ReleaseTask
2010-09-07 10:08:46    I    #1948    Manage    Releasing Task Cookie=17512344
2010-09-07 10:08:46    I    #1948    Sched    <<--ReleaseTask

[apoling]

Hi,

please see KB58966 for troubleshooting issues through log files.

I think first by enabling loglevel 8, you could have enough information of the cause. If that won't help, continue by debug logging.

I would recommend always seeing McScript.log for checking update issues, because agent log does not have enough info.

Attila

[tonyb99]

Have you tried this KB https://kc.mcafee.com/corporate/index?page=content&id=KB60739&actp=search&viewlocale=en_US&searchid=...