Cannot install PA agent through ePO RedHat 8

[nickolsj]

Hi,

Trying to push the policy auditor agent through ePO to a RedHat (RHEL) 8 system.  Everything indicates that it successfully installed when reviewing masvc_<host>.log file, but ePO never sees PA as installed.  Looking further the paa-install.log shows : "failed to move plugin ..., are you root?"  I am pushing this through ePO why would it be asking this?  I checked the /tmp directory it is permissioned as 777 root:root and the noexec cmd is not listed in the fstab file for the directory. 

I haven't but could try manually installing.  However, when rolling out a bunch of RHEL8 servers, manually installing becomes less of an option. Plus I'm concerned that this will affect updating the module when new versions are released.

Any ideas where to go from here?  

ePO Version 5.10.0

Policy Auditor agent 6.5.1.230

Red Hat Enterprise release 8.4

[vivs]

Hello,

Anything you are seeing in the McScript_deploy.log ?

Was my reply helpful?
If you find this post useful, Please give it a Kudos! Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!

[nickolsj]

Here are a few of the errors I am seeing in various logs.  There are a lot of  "hash mismatch" errors.  I created the agent install.sh from ePO and installed manually. Not sure why the ePO server would refuse to connect or why there is a hash mismatch.  I did unzip the script prior to uploading to the client.  Not sure if this would change the hash of anything and I have do this all the time w/o any issues.  It doesn't identify what hash is being compared to either.  Can you see anything in these log snips that stand out?

mcafee agent version: 5.7.4.418  --I have checked known issues for the agent and policy auditor and do not see anything that seems relevant to my issue

McScript_.log:

"[downloader] [E] Downloading file from <https://server ip>:443/Software/Current/AUENGINEMETA/BMContent/0000/PkgCatalog.z?hash={###} to /var/McAfee/agent/update/Current/AUENGINEMETA/BMContent/0000/PkgCatalog.z failed."

masvc_.log : 

"dns resolution failed for repository <name:<NAME>> with uv err <ENOENT>"

" msgbus.Warning: hash comparisons match failed"

"request failed with curl error <7>, response code <0>, http connect code 0
[2021-10-14 20:01:21.879 curl text 61 connect to x.x.x.x port 443 failed: Connection refused ]"

mapolicy_.log:

"policy.Error: ma_get_manifest_from_db failed!"

McScript_deploy.log:

"[MueEep] [I] Invoking EndUpdateDialog withTitle " <207>" Message " Please check the update log for more details." CountdownMessage " " CountdownValue" 0""
2021-10-15 03:00:04 [18964] (16384) [SessMgr] [I] Final session state is 9
2021-10-15 03:00:04 [18964] (16384) [mue] [I] Updater session state = <9>, Update session result = "FAILED"

[nickolsj]

Still no success.  I have found some more info:  when attempting to run 

/opt/McAfee/auditengine/bin/auditmanager 

I get the following error:

./auditmanager: error while loading shared libraries: libboost_system-gcc65-mt-x32-1_67.so.1.67.0: cannot open shared object file: No such file or directory

Checking /opt/McAfee/auditengine/lib that file exists and is permissioned as 755.  Tried chmoding it to 777; same result.

Running "auditmanager.sh start"  returns:

Starting McAfee AuditManager service... [ FAILED ]

Trying to run any of the other scripts or commands in the auditengine directory results in the shared library failure or service failure.

??? 

Do any McAfee mods or employees even monitor these forums?

[vivs]

Hello,

In masvc.log , I can see this:

request failed with curl error <7>, response code <0>, http connect code 0
[2021-10-14 20:01:21.879 curl text 61 connect to x.x.x.x port 443 failed: Connection refused ]

https://kc.mcafee.com/corporate/index?page=content&id=KB74939&locale=en_US

CURLE_COULDNT_CONNECT (7)

Failed to connect to host or proxy.

This seems to be a network issue and if you think everything is fine from network end then open a Service Request with support for the Quicker Resolution.

Was my reply helpful?
If you find this post useful, Please give it a Kudos! Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!