cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
nashcoop
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 1 of 5

Event ID 37008 "MOVE-OSS is disconnected from TIE Server" notifications

Over the weekend following the installation of MS updates thousands of notifications for event ID 37008 "MOVE-OSS is disconnected from TIE Server" were logged in EPO referencing the SVM's that were rebooted.  It affected four different SVM's, and one of those did not stop spitting out the notifications until I manually rebooted the server.  The affected SVM's are running Move 4.6.0.396 multiplatform, VirusScan 8.8 with Patch 13, McAfee Agent 5.6.1.157.  I do not have a SVM Manager, and I do not have TIE functionality enabled in the policy catalog under Shared Cloud Solutions.  I'm not sure why rebooting the servers over the weekend would have caused these SVM's to generate eight thousand notifications about the "MOVE-OSS is disconnected from TIE Server" even after the system reboots completed.  Is this a known bug?  I can't find any KB's about it.

4 Replies
jsam
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 5

Re: Event ID 37008 "MOVE-OSS is disconnected from TIE Server" notifications

Hi, couple of thoughts

Do you have the VSE TIEM module installed on the SVM ?
If present VSE TIE logs = %programdata%\McAfee\TIEM
Typically review TIEMVE.log first

RDP to the McAfee MOVE AntiVirus SVM system.
System tray, click, select About
Under McAfee Data Exchange Layer, does it confirm DXL Connected Status is "Connected" ?

Kb= How to prevent DXL clients from connecting to a broker after installing McAfee Agent 5.6 . Technical Articles ID: KB91155

 

nashcoop
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 3 of 5

Re: Event ID 37008 "MOVE-OSS is disconnected from TIE Server" notifications

I opened a ticket for this issue (Service Requests 4-20164476961) which you can review.  The ticket was closed.  Since I'm not currently using DXL my only option was to disable Event 37008 in EPO.  I was told MOVE engineering is aware of the issue however they consider it a cosmetic logging problem for people using McAfee Agent 5.6.1.157 but not utilizing TIE, and have marked it as a "Will not fix" issue since DXL is becoming more prevalent and is going to be further integrated in future releases.

bleeder
Level 9
Report Inappropriate Content
Message 4 of 5

Re: Event ID 37008 "MOVE-OSS is disconnected from TIE Server" notifications

I'm also having this problem and McAfee's response was similarly not well-received.  We will be moving away from McAfee in the future.

Hawre
Level 7
Report Inappropriate Content
Message 5 of 5

Re: Event ID 37008 "MOVE-OSS is disconnected from TIE Server" notifications

I have the same problem and DXL shows disconnected on my DMZ svm offload scanner. do you know why?

 

Thank you, 

Hawre  

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community