What does AMCore changed state to 2 mean?

[User40472738]

What are the different AMCore states and what is their significance?

[abel_pan]

Hi,

Do you mean McAfee ENS can roll back AMCore content for 2 version .

What is intention and different AMCore states ?

[Thussain]

Thank you for posting your query here

A maximum of 3 versions of content are available on the system at a given time: the content currently in use, and the 2 prior content versions. When an update is performed, the current content is stored in backup. If there are already 2 prior versions of content backed up on the system when an update occurs, the oldest version is replaced by the current content.

[AdithyanT]

Hi @abel_pan,

Thank you for your post. May I know where you find this statement? Any specific log file you are looking into?

[User40472738]

It's not about Rolling back AMCore. I saw this in the Adaptive Threat protection logs.

Orchestrator.AMCoreUtil.Error: AMCore is fully not initialized & state is 9
02/12/2019 10:17:41.244 AM mfeatp(5448.13680) <SYSTEM> Orchestrator.JCM.Debug: Using default GTI settings
02/12/2019 10:17:41.259 AM mfeatp(5448.13680) <SYSTEM> Orchestrator.AMCoreUtil.Error: AMCore is fully not initialized & state is 9
02/12/2019 10:17:41.259 AM mfeatp(5448.13680) <SYSTEM> Orchestrator.JCM.Debug: SafetyFrameworkV3 is not Enabled
02/12/2019 10:17:41.259 AM mfeatp(5448.13680) <SYSTEM> Orchestrator.JCM.Activity: System is not using proxy
02/12/2019 10:17:41.821 AM mfeatp(5448.13680) <SYSTEM> Orchestrator.JCM.Debug: Successfully initialized JCM
02/12/2019 10:17:41.821 AM mfeatp(5448.13680) <SYSTEM> Orchestrator.JCM.Debug: Reputation BO native interface obtained
02/12/2019 10:17:41.821 AM mfeatp(5448.13680) <SYSTEM> Orchestrator.JCM.Activity: Connectivity status is McAfee GTI Connectivity Only
02/12/2019 10:17:41.821 AM mfeatp(5448.13680) <SYSTEM> Orchestrator.OES.Activity: Configuring JTI scanner
02/12/2019 10:17:41.821 AM mfeatp(5448.13680) <SYSTEM> Orchestrator.AMCoreUtil.Error: AMCore is fully not initialized & state is 9
02/12/2019 10:17:41.852 AM mfeatp(5448.13680) <SYSTEM> Orchestrator.AMCoreUtil.Error: AMCore is fully not initialized & state is 9

Is it something related to AMCore definition file not being loaded properly into McAfee ATP or is it being updated at that time? I saw similar messages on other systems where the state was either '2' or '9'. I wasn't able to find anything in the product guide or knowledge base.

[AdithyanT]

Hi @User40472738,

Thanks for clearing that! This is a very good question although, I would not be very sure if these obfuscated details from log files are actually shareable. Please give me some time while I look this up for you!

[AdithyanT · Accepted solution]

Hi @User40472738,

Thanks for your patience. looks like we have internal notes for support on this, however, unsure if this is shareable.

However, on a very general understanding, AMCore state 2 is to let us know that your product installed has gone through a "change" (upgrade/update/policy change).

state 9 would point to the scanner service starting up.

May I know if there are any functional impact due to this? Is there any specific reason you are looking out for these values?

Unless there are any actual impact functionally, I would not recommend taking these message in it's literal sense and would recommend contacting technical Support for investigation as some of them are momentary and non significant for everyday functionality of product.

[User40472738]

Thanks for the information. It's not impacting anything, I was just curious about these messages in the ATP log. 

[AdithyanT]

Hi @User40472738,

Glad to be of assistance! Kudos to your efforts!