cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Former Member
Not applicable
Report Inappropriate Content
Message 1 of 8

Threat Prevention Update, not working

I'm trying to setup my personal mac for work, and I installed Endpoint Security for Mac (10.6.6). However it doesn't pick up the latest DAT for some reason. Our IT gave up on me, please help me out. I attached the log file. It says something like below everytime.

 

2020-11-11 12:32:50 [2179] (4558360000) [ScrptExe] [E] Error trace:
2020-11-11 12:32:50 [2179] (4558360000) [Log] [E] [Main thread]->
2020-11-11 12:32:50 [2179] (4558360000) [SessMgr] [E] [SessionManager::runScript:/var/McAfee/agent/update/UpdateMain.McS]->
2020-11-11 12:32:50 [2179] (4558360000) [ScrptExe] [E] [Executing section ScriptMain]->
2020-11-11 12:32:50 [2179] (4558360000) [ScrptExe] [E] [CallIf]->
2020-11-11 12:32:50 [2179] (4558360000) [ScrptExe] [E] [Executing section StartUpdateProcess]->
2020-11-11 12:32:50 [2179] (4558360000) [ScrptExe] [E] [Call]->
2020-11-11 12:32:50 [2179] (4558360000) [ScrptExe] [E] [Executing section DetectInstalledProductsAndUpdate]->
2020-11-11 12:32:50 [2179] (4558360000) [ScrptExe] [E] [Call]->
2020-11-11 12:32:50 [2179] (4558360000) [ScrptExe] [E] [Executing section GetDetectionScripts]->
2020-11-11 12:32:50 [2179] (4558360000) [ScrptExe] [E] [Call]->
2020-11-11 12:32:50 [2179] (4558360000) [ScrptExe] [E] [Executing section FindAndExecuteDetectionScripts]->
2020-11-11 12:32:50 [2179] (4558360000) [ScrptExe] [E] [LoopIf]->
2020-11-11 12:32:50 [2179] (4558360000) [ScrptExe] [E] [Executing section EnumerateThroughProductIDList]->
2020-11-11 12:32:50 [2179] (4558360000) [ScrptExe] [E] [LoopIf]->
2020-11-11 12:32:50 [2179] (4558360000) [ScrptExe] [E] [Executing section EnumerateThroughFile]->
2020-11-11 12:32:50 [2179] (4558360000) [ScrptExe] [E] [Call]->
2020-11-11 12:32:50 [2179] (4558360000) [ScrptExe] [E] [Executing section ExecuteDetectionScript]->
2020-11-11 12:32:50 [2179] (4558360000) [ScrptExe] [E] [Line 614: RunScript dwRet = /var/McAfee/agent/update/Current/MED_DAT_1000/datdet.mcs, ScriptMain]->
2020-11-11 12:32:50 [2179] (4558360000) [ScrptExe] [E] [Executing section ScriptMain]->
2020-11-11 12:32:50 [2179] (4558360000) [ScrptExe] [E] Command failed...CallIf
2020-11-11 12:32:50 [2179] (4558360000) [ScrptExe] [I] Script executed. Setting dwRet to 18

7 Replies
AjaySundar
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 8

Re: Threat Prevention Update, not working

Hi @Former Member,

Good day to you!

We checked the error log and it seems to be more of an issue with the McAfee Agent not executing the DAT update script.

2020-11-11 12:25:05 [2014] (4403912128) [ScrptExe] [E] /var/McAfee/agent/update/Current/MED_DAT_1000/datdet.mcs did not execute succesfully

To investigate this further, we request you to open an SR with the McAfee Agent team along with the McAfee Agent MER from the machine.

The instruction to generate an SR is available in the below article.

https://kc.mcafee.com/corporate/index?page=content&id=KB86785

I hope this helps.

Regards,

AJ

Former Member
Not applicable
Report Inappropriate Content
Message 3 of 8

Re: Threat Prevention Update, not working

Our IT says that I can't register to the support site, I'm doing internal escalation, but no luck so far. And the output is too large to attach here. I did re-install and took the script logs from the beginning, could you please take a look at these to see if anything rings a bell .. Thanks

Former Member
Not applicable
Report Inappropriate Content
Message 4 of 8

Re: Threat Prevention Update, not working

saw something like this .. 

2020-11-13 09:11:25 [825] (4645096896) [ScrptExe] [E] [Line 1339: RunScript dwRet = /var/McAfee/agent/update/Current/VSCANDAT1000/DAT/0000/V2datinstall.mcs, ScriptMain]->
2020-11-13 09:11:25 [825] (4645096896) [CmdPrsr] [E] Parse error line 2445 column 14: expected TEMP or TMP or WINDOWS or SYSTEM or SYSTEMDRIVE or USER or ALLUSERS or PROGRAM_FILES or PROGRAM_FILES_COMMON or DESKTOP or MYDOCUMENTS or COMMON_DOCUMENTS or STARTMENU or COMMON_STARTMENU or STARTUP or COMMON_STARTUP or CURRENT_SCRIPT or APPDIR or WINDIR or SYSTEMROOT

aguevara
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 5 of 8

Re: Threat Prevention Update, not working

 

Hello taroplus

 

I am from the ePO/ MA team also looking at these logs.

 

The error you have highlighted is indeed an error but not the cause of the update failure, instead what i see on the logs causing this is the below:

 

2020-11-13 09:19:01 [1023]  (4668042688) [downloader] [I] Downloading file from https://yourrepositoryIP:port/Software/Current/VSCANDAT1000/DAT/0000/avvdat-9804.zip?hash=9881A795CFF4929EA4670C94A2CD45DD6E0BA98F to /var/McAfee/agent/update/Current/VSCANDAT1000/DAT/0000/avvdat-9804.zip success.

2020-11-13 09:19:01 [1023]  (4668042688) [downloader] [I] changing permission...

2020-11-13 09:19:01 [1023]  (4668042688)   [ScrptExe] [I] Executing section: [UnZipDATFile]

2020-11-13 09:19:01 [1023]  (4668042688)   [ScrptMgr] [I] Setting the working dir as /var/McAfee/agent/update/Current/VSCANDAT1000/DAT/0000

2020-11-13 09:19:01 [1023]  (4668042688)   [ScrptExe] [I] Executing section: [GetExtraFilesInDATPack]

2020-11-13 09:19:01 [1023]  (4668042688) [UpdatePlugin] [I] Getting product information using msgbus

2020-11-13 09:19:01 [1023]  (4668042688) [downloader] [E] UpdateCallbackMsgbus::extractResponse, Failed to get the update info sync from update info.

2020-11-13 09:19:01 [1023]  (4668042688)   [ScrptExe] [E] Error trace:

2020-11-13 09:19:01 [1023]  (4668042688)        [Log] [E]  [Main thread]->

2020-11-13 09:19:01 [1023]  (4668042688)    [SessMgr] [E]  [SessionManager::runScript:/var/McAfee/agent/update/UpdateMain.McS]->

2020-11-13 09:19:01 [1023]  (4668042688)   [ScrptExe] [E]  [Executing section ScriptMain]->

2020-11-13 09:19:01 [1023]  (4668042688)   [ScrptExe] [E]  [CallIf]->

2020-11-13 09:19:01 [1023]  (4668042688)   [ScrptExe] [E]  [Executing section StartUpdateProcess]->

2020-11-13 09:19:01 [1023]  (4668042688)   [ScrptExe] [E]  [Call]->

2020-11-13 09:19:01 [1023]  (4668042688)   [ScrptExe] [E]  [Executing section DetectInstalledProductsAndUpdate]->

2020-11-13 09:19:01 [1023]  (4668042688)   [ScrptExe] [E]  [Call]->

2020-11-13 09:19:01 [1023]  (4668042688)   [ScrptExe] [E]  [Executing section GetDetectionScripts]->

2020-11-13 09:19:01 [1023]  (4668042688)   [ScrptExe] [E]  [Call]->

2020-11-13 09:19:01 [1023]  (4668042688)   [ScrptExe] [E]  [Executing section FindAndExecuteDetectionScripts]->

2020-11-13 09:19:01 [1023]  (4668042688)   [ScrptExe] [E]  [LoopIf]->

2020-11-13 09:19:01 [1023]  (4668042688)   [ScrptExe] [E]  [Executing section EnumerateThroughProductIDList]->

2020-11-13 09:19:01 [1023]  (4668042688)   [ScrptExe] [E]  [LoopIf]->

2020-11-13 09:19:01 [1023]  (4668042688)   [ScrptExe] [E]  [Executing section EnumerateThroughFile]->

2020-11-13 09:19:01 [1023]  (4668042688)   [ScrptExe] [E]  [Call]->

2020-11-13 09:19:01 [1023]  (4668042688)   [ScrptExe] [E]  [Executing section ExecuteDetectionScript]->

2020-11-13 09:19:01 [1023]  (4668042688)   [ScrptExe] [E]  [Line 614:  RunScript dwRet = /var/McAfee/agent/update/Current/VSCANDAT1000/V2datdet.mcs, ScriptMain]->

2020-11-13 09:19:01 [1023]  (4668042688)   [ScrptExe] [E]  [Executing section ScriptMain]->

2020-11-13 09:19:01 [1023]  (4668042688)   [ScrptExe] [E]  [CallIf]->

2020-11-13 09:19:01 [1023]  (4668042688)   [ScrptExe] [E]  [Executing section RunUpdate]->

2020-11-13 09:19:01 [1023]  (4668042688)   [ScrptExe] [E]  [Call]->

2020-11-13 09:19:01 [1023]  (4668042688)   [ScrptExe] [E]  [Executing section RunInstallScript]->

2020-11-13 09:19:01 [1023]  (4668042688)   [ScrptExe] [E]  [Line 1339:  RunScript dwRet = /var/McAfee/agent/update/Current/VSCANDAT1000/DAT/0000/V2datinstall.mcs, ScriptMain]->

2020-11-13 09:19:01 [1023]  (4668042688)   [ScrptExe] [E]  [Executing section ScriptMain]->

2020-11-13 09:19:01 [1023]  (4668042688)   [ScrptExe] [E]  [LoopIf]->

2020-11-13 09:19:01 [1023]  (4668042688)   [ScrptExe] [E]  [Executing section EnumerateThroughProducts]->

2020-11-13 09:19:01 [1023]  (4668042688)   [ScrptExe] [E]  [Call]->

2020-11-13 09:19:01 [1023]  (4668042688)   [ScrptExe] [E]  [Executing section UpdateProduct]->

2020-11-13 09:19:01 [1023]  (4668042688)   [ScrptExe] [E]  [CallIf]->

2020-11-13 09:19:01 [1023]  (4668042688)   [ScrptExe] [E]  [Executing section MacFrameworkUpdate]->

2020-11-13 09:19:01 [1023]  (4668042688)   [ScrptExe] [E]  [CallIf]->

2020-11-13 09:19:01 [1023]  (4668042688)   [ScrptExe] [E]  [Executing section GetExtraFilesInDATPack]->

2020-11-13 09:19:01 [1023]  (4668042688)   [ScrptExe] [E]  [GetProductInfo]->

2020-11-13 09:19:01 [1023]  (4668042688)   [ScrptExe] [E]   Failed to get the product information.  Setting ExtraFile to FALSE

2020-11-13 09:19:01 [1023]  (4668042688)   [ScrptExe] [I] Executing section: [PreNotifyDAT]

2020-11-13 09:19:01 [1023]  (4668042688)   [ScrptMgr] [I] Pre-notifying for DAT update.

2020-11-13 09:19:01 [1023]  (4668042688) [downloader] [E] UpdateCallbackMsgbus::extractResponse, Failed to get the update info sync from update info.

2020-11-13 09:19:01 [1023]  (4668042688)   [ScrptExe] [I] Executing section: [CreateNewDATDir]

2020-11-13 09:19:01 [1023]  (4668042688) [UpdatePlugin] [I] Getting product information using msgbus

2020-11-13 09:19:01 [1023]  (4668042688) [downloader] [E] UpdateCallbackMsgbus::extractResponse, Failed to get the update info sync from update info.

2020-11-13 09:19:01 [1023]  (4668042688)   [ScrptExe] [I] Executing section: [ApplyDATs]

2020-11-13 09:19:01 [1023]  (4668042688)   [ScrptMgr] [I] Copying DAT.

2020-11-13 09:19:01 [1023]  (4668042688)   [ScrptExe] [I] Executing section: [CopyDATs]

2020-11-13 09:19:01 [1023]  (4668042688)   [ScrptExe] [I] Executing section: [CopyDATsNoMove]

2020-11-13 09:19:01 [1023]  (4668042688)   [ScrptExe] [I] Line 1772:  CopyFilesByMask bRet = /var/McAfee/agent/update/UpdateDir, /usr/local/McAfee/AntiMalware/var/tmp/dats/, avvscan.dat

2020-11-13 09:19:02 [1023]  (4668042688)   [ScrptExe] [I] Line 1775:  CopyFilesByMask bRet = /var/McAfee/agent/update/UpdateDir, /usr/local/McAfee/AntiMalware/var/tmp/dats/, avvnames.dat

2020-11-13 09:19:02 [1023]  (4668042688)   [ScrptExe] [I] Line 1778:  CopyFilesByMask bRet = /var/McAfee/agent/update/UpdateDir, /usr/local/McAfee/AntiMalware/var/tmp/dats/, avvclean.dat

2020-11-13 09:19:02 [1023]  (4668042688)   [ScrptExe] [I] Executing section: [CheckMacUpdate]

2020-11-13 09:19:02 [1023]  (4668042688)   [ScrptExe] [I] Executing section: [CheckMacDATUpdate]

2020-11-13 09:19:02 [1023]  (4668042688) [UpdatePlugin] [I] Getting product information using msgbus

2020-11-13 09:19:02 [1023]  (4668042688) [downloader] [E] UpdateCallbackMsgbus::extractResponse, Failed to get the update info sync from update info.

2020-11-13 09:19:02 [1023]  (4668042688)   [ScrptExe] [E] Error trace:

2020-11-13 09:19:02 [1023]  (4668042688)        [Log] [E]  [Main thread]->

2020-11-13 09:19:02 [1023]  (4668042688)    [SessMgr] [E]  [SessionManager::runScript:/var/McAfee/agent/update/UpdateMain.McS]->

2020-11-13 09:19:02 [1023]  (4668042688)   [ScrptExe] [E]  [Executing section ScriptMain]->

2020-11-13 09:19:02 [1023]  (4668042688)   [ScrptExe] [E]  [CallIf]->

2020-11-13 09:19:02 [1023]  (4668042688)   [ScrptExe] [E]  [Executing section StartUpdateProcess]->

2020-11-13 09:19:02 [1023]  (4668042688)   [ScrptExe] [E]  [Call]->

2020-11-13 09:19:02 [1023]  (4668042688)   [ScrptExe] [E]  [Executing section DetectInstalledProductsAndUpdate]->

2020-11-13 09:19:02 [1023]  (4668042688)   [ScrptExe] [E]  [Call]->

2020-11-13 09:19:02 [1023]  (4668042688)   [ScrptExe] [E]  [Executing section GetDetectionScripts]->

2020-11-13 09:19:02 [1023]  (4668042688)   [ScrptExe] [E]  [Call]->

2020-11-13 09:19:02 [1023]  (4668042688)   [ScrptExe] [E]  [Executing section FindAndExecuteDetectionScripts]->

2020-11-13 09:19:02 [1023]  (4668042688)   [ScrptExe] [E]  [LoopIf]->

2020-11-13 09:19:02 [1023]  (4668042688)   [ScrptExe] [E]  [Executing section EnumerateThroughProductIDList]->

2020-11-13 09:19:02 [1023]  (4668042688)   [ScrptExe] [E]  [LoopIf]->

2020-11-13 09:19:02 [1023]  (4668042688)   [ScrptExe] [E]  [Executing section EnumerateThroughFile]->

2020-11-13 09:19:02 [1023]  (4668042688)   [ScrptExe] [E]  [Call]->

2020-11-13 09:19:02 [1023]  (4668042688)   [ScrptExe] [E]  [Executing section ExecuteDetectionScript]->

2020-11-13 09:19:02 [1023]  (4668042688)   [ScrptExe] [E]  [Line 614:  RunScript dwRet = /var/McAfee/agent/update/Current/VSCANDAT1000/V2datdet.mcs, ScriptMain]->

2020-11-13 09:19:02 [1023]  (4668042688)   [ScrptExe] [E]  [Executing section ScriptMain]->

2020-11-13 09:19:02 [1023]  (4668042688)   [ScrptExe] [E]  [CallIf]->

2020-11-13 09:19:02 [1023]  (4668042688)   [ScrptExe] [E]  [Executing section RunUpdate]->

2020-11-13 09:19:02 [1023]  (4668042688)   [ScrptExe] [E]  [Call]->

2020-11-13 09:19:02 [1023]  (4668042688)   [ScrptExe] [E]  [Executing section RunInstallScript]->

2020-11-13 09:19:02 [1023]  (4668042688)   [ScrptExe] [E]  [Line 1339:  RunScript dwRet = /var/McAfee/agent/update/Current/VSCANDAT1000/DAT/0000/V2datinstall.mcs, ScriptMain]->

2020-11-13 09:19:02 [1023]  (4668042688)   [ScrptExe] [E]  [Executing section ScriptMain]->

2020-11-13 09:19:02 [1023]  (4668042688)   [ScrptExe] [E]  [LoopIf]->

2020-11-13 09:19:02 [1023]  (4668042688)   [ScrptExe] [E]  [Executing section EnumerateThroughProducts]->

2020-11-13 09:19:02 [1023]  (4668042688)   [ScrptExe] [E]  [Call]->

2020-11-13 09:19:02 [1023]  (4668042688)   [ScrptExe] [E]  [Executing section UpdateProduct]->

2020-11-13 09:19:02 [1023]  (4668042688)   [ScrptExe] [E]  [CallIf]->

2020-11-13 09:19:02 [1023]  (4668042688)   [ScrptExe] [E]  [Executing section MacFrameworkUpdate]->

2020-11-13 09:19:02 [1023]  (4668042688)   [ScrptExe] [E]  [Call]->

2020-11-13 09:19:02 [1023]  (4668042688)   [ScrptExe] [E]  [Executing section CheckMacUpdate]->

2020-11-13 09:19:02 [1023]  (4668042688)   [ScrptExe] [E]  [CallIf]->

2020-11-13 09:19:02 [1023]  (4668042688)   [ScrptExe] [E]  [Executing section CheckMacDATUpdate]->

2020-11-13 09:19:02 [1023]  (4668042688)   [ScrptExe] [E]  [GetProductInfo]->

2020-11-13 09:19:02 [1023]  (4668042688)   [ScrptExe] [E]   Failed to get the product information.  Setting bRet to FALSE

2020-11-13 09:19:02 [1023]  (4668042688)   [ScrptExe] [I] Executing section: [NotifyFail]

2020-11-13 09:19:02 [1023]  (4668042688)   [ScrptExe] [I] Executing section: [SetUpdateErrorFail]

2020-11-13 09:19:02 [1023]  (4668042688)   [ScrptExe] [I] Executing section: [NotifyFailDAT]

2020-11-13 09:19:02 [1023]  (4668042688)   [ScrptMgr] [I] Update failed to version 9804.0000.

2020-11-13 09:19:02 [1023]  (4668042688)     [MueEep] [I] Invoking events withEventId " 0" Severity " 4" Productid " ENDP_AM_1060MACX" Locale " 0000" UpdateType " DAT" UpdateError " -1" iUpdateState " 9" New Version " 9804.0000" Date Time " " Script Id" 1234358673" Custom Message " "

2020-11-13 09:19:02 [1023]  (4668042688)     [MueEep] [I] Updating session state to  9

2020-11-13 09:19:02 [1023]  (4668042688)     [MueEep] [I] Updating final session state to  9

2020-11-13 09:19:02 [1023]  (4668042688) [downloader] [E] UpdateCallbackMsgbus::extractResponse, Failed to get the update info sync from update info.

2020-11-13 09:19:02 [1023]  (4668042688)     [MueEep] [I] Invoking events withEventId " 0" Severity " 0" Productid " " Locale " 0409" UpdateType " " UpdateError " 0" iUpdateState " 17" New Version " " Date Time " " Script Id" 1234358673" Custom Message " "

 

 

------------------------

 

The important bits are:

 

2020-11-13 09:19:01 [1023]  (4668042688) [downloader] [E] UpdateCallbackMsgbus::extractResponse, Failed to get the update info sync from update info.

 

2020-11-13 09:19:02 [1023]  (4668042688)   [ScrptExe] [E]   Failed to get the product information.  Setting bRet to FALSE

 

Update failed to version 9804.0000.

 

that will mean that the Mcafee agent and End point security are having issues communicating with each other, in other words the agent is downloading the DAT files but cannot pass it to Endpoint security as it can communicate with it locally.

 

There are multiple reasons for this and the best course of action is to reinstall ENS if possible on the affected machine to register itself again with the Mcafee Agent

Former Member
Not applicable
Report Inappropriate Content
Message 6 of 8

Re: Threat Prevention Update, not working

I tried uninstall/install many times ... like 10 times. I even installed Mojave, but all same result.

I attached the logs from /var/McAfee/agent/logs (i'm still working on internal IT escalation), if you can take a look, it would be appreciated.

AjaySundar
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 7 of 8

Re: Threat Prevention Update, not working

Hi @Former Member,

Good day to you!

I checked the logs provided and as mentioned by my colleague there are problems with the McAfee agent communicating with the installed point product.

With the new logs, there seems to be a problem with the DAT file getting downloaded.

2020-11-14 18:17:43 [2476] (4429184448) [downloader] [E] Downloading file from https://epoah.oracle.com:443/Software/Current/VSCANDAT1000/DAT/0000/avvdat-9805.zip?hash=2D969AC9893C733BABC9E6517C7DE7AAC4FB572E to /var/McAfee/agent/update/Current/VSCANDAT1000/DAT/0000/avvdat-9805.zip failed.

2020-11-14 18:17:43 [2476] (4429184448) [ScrptUtl] [E] Failed to download from repository

We would need to investigate this further, please open a service request with the technical support for this.

Additionally, we would like you to try the manual DAT update method on a single machine to understand if the issue with the ENS or the MA. The instruction is available in the below article.

https://kc.mcafee.com/corporate/index?page=content&id=KB70253&locale=en_IN&viewlocale=en_IN

Thanks,

AJ

aguevara
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 8 of 8

Re: Threat Prevention Update, not working

Hello taroplus

Looks like the download of that file is failing:

https://yourrepository:port/Software/Current/VSCANDAT1000/DAT/0000/avvdat-9805.zip?hash=2D969AC9893C733BABC9E6517C7DE7AAC4FB572E

Please note that i have mask the beginning of the URL (https://yourrepository:port)

Can you try downloading that file from a browser on the affected machine?

Regards

Alejandro

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community