cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
ASF-VA
Level 8
Report Inappropriate Content
Message 1 of 9

ePO Event ID 1119 - Update task - Error

Jump to solution

Hello,

I have many Event ID 1119 in my Threat Event Log, regarding an Assigned Client Tasks for DAT Update on many Linux servers.

I know the task is OK because some of my servers have an up to date DAT.
But for some reasons, the other servers can't update their DAT version.

The event ID 1119 come with an event description: The update failed; see event log

So, my question is... Where or what is this Event log? I check all the logs I could see on my client server, for the agent and ENS, but I can't see anything relevant.

I also check this post:
https://community.mcafee.com/t5/ePolicy-Orchestrator-ePO/SOLVED-HOW-TO-TROUBLESHOOT-CLIENT-UPDATE-DE...

And I do have an exit status as 0 for my update task in MASVC_ComputerName.log:
2022-02-22 11:45:40.532 (1438.1438) Updater.Info: Updater engine exited with exit status as 0 and term signal 0.

So I'm pretty confused...

Thanks for your help,

1 Solution

Accepted Solutions
Nitisha_Awas
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 8 of 9

Re: ePO Event ID 1119 - Update task

Jump to solution

Hi,

As per the document /var directory would require a minimum of 3 GB of partition.

https://docs.mcafee.com/bundle/endpoint-security--v10-7-0-installation-guide-linux/page/GUID-04C3975...

With the log entry specified in the post, it looks like to be a space issue.

"Feb 22 16:40:38 My_Server ERROR ConfigStoreUtility [6478] Not writing to file as disk space available is less than 200 MB, current available disk space: 118247424"

However, Please gather ENSL MER and MA MER when the issue occurs and log a service request with Tech support to investigate further.

ENSL MER: https://kc.mcafee.com/corporate/index?page=content&id=KB88197

MA Logs: https://kc.mcafee.com/corporate/index?page=content&id=KB83005

Hope this helps.

View solution in original post

8 Replies
cdinet
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 9

Re: ePO Event ID 1119 - Update task

Jump to solution

1119 is an event returned by ens, not the agent.  If the mcscript log doesn't show any errors, check some of the ens logs in this folder and sub folders.

/var/McAfee/ens/log

mcscript log would be located in the McAfee/agent/log folder

 

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

ASF-VA
Level 8
Report Inappropriate Content
Message 3 of 9

Re: ePO Event ID 1119 - Update task

Jump to solution

I checked in the mcscript log, and it says everything is fine:
2022-02-22 16:40:43.240 (1438.1438) Updater.Info: Updater engine exited with exit status as 0 and term signal 0.
2022-02-22 16:40:44.240 (1438.1438) scheduler.Info: Deploy_Task is successful

But in the mfetpd.log, I have this error:
Feb 22 16:40:38 My_Server ERROR ConfigStoreUtility [6478] Not writing to file as disk space available is less than 200 MB, current available disk space: 118247424

But I checked on my server, and I have no disk space problem... I can't find which partition this log is talking about...
Any idea?

cdinet
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 4 of 9

Re: ePO Event ID 1119 - Update task

Jump to solution

Does it mention it anywhere else in the log?  You might want to ask the ens team about that.  I can move this over to them for you.

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

Nitisha_Awas
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 5 of 9

Re: ePO Event ID 1119 - Update task

Jump to solution

Hi,

Events 1119 and 1121 are basically informational events generated if any task applied on the system (deployment/update) is having multiple packages which are incorrect (not relevant for the OS) then we could see these events getting triggered.

For Example: 

ENSL would require MED_DAT and Linux Engine and if your task is having V2, Amcore,  MACEngine selected apart from MED_DAT rest would fail, which in turn would need to send an event cause the other packages failed.

Due to the presence of all the packages in the task, Linux system is only taking up MED_DAT and Linux engine and others are bailing out because they are not meant for Linux OS, hence you could see the event 1119 and 1121 generated as an informational event telling other packages failed to update on the machine.

========================================================

With regards to disk space, kindly make sure the minimum requirement is met.

  • Installation directory — Minimum 2.5 GB
  • /opt/McAfee directory — Minimum 750 MB
  • /tmp directory — Minimum 1 GB free space
  • /var directory — Minimum 3 GB partition, 750 MB free space

https://docs.mcafee.com/bundle/endpoint-security--v10-7-0-installation-guide-linux/page/GUID-04C3975...

Hope this helps.

Was my reply helpful?

If you find this post useful, please give it a Kudos! Also, please don't forget to select "Accept as a solution" if this reply resolves your query!

 

ASF-VA
Level 8
Report Inappropriate Content
Message 6 of 9

Re: ePO Event ID 1119 - Update task

Jump to solution
I have other servers that have the same configuration, same engine, etc... That's why I don't understand...

I checked the minimum requirement, everything seems fine.
For Security reason, we had to create a different partition for /Var/Mcafee, but even if it's only 1.5Go, there is more than 900Mo free. Could it be a problem?
ASF-VA
Level 8
Report Inappropriate Content
Message 7 of 9

Re: ePO Event ID 1119 - Update task

Jump to solution
Can't see in the log any location for the low space partition.

I might open directly a case if I can't find a solution.
Nitisha_Awas
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 8 of 9

Re: ePO Event ID 1119 - Update task

Jump to solution

Hi,

As per the document /var directory would require a minimum of 3 GB of partition.

https://docs.mcafee.com/bundle/endpoint-security--v10-7-0-installation-guide-linux/page/GUID-04C3975...

With the log entry specified in the post, it looks like to be a space issue.

"Feb 22 16:40:38 My_Server ERROR ConfigStoreUtility [6478] Not writing to file as disk space available is less than 200 MB, current available disk space: 118247424"

However, Please gather ENSL MER and MA MER when the issue occurs and log a service request with Tech support to investigate further.

ENSL MER: https://kc.mcafee.com/corporate/index?page=content&id=KB88197

MA Logs: https://kc.mcafee.com/corporate/index?page=content&id=KB83005

Hope this helps.

ASF-VA
Level 8
Report Inappropriate Content
Message 9 of 9

Re: ePO Event ID 1119 - Update task

Jump to solution

We added some space to the /var/mcafee, and it seems to work fine now.

I do not want to start picking holes, but it would be nice to have a more explicit error message, or to point at the problematic partition...
Even if I agree we were not exactly metting the minimum requirement.

Anyway, thank you very much for your help !

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community