cancel
Showing results for 
Search instead for 
Did you mean: 

Critical Rollout issue!

Hello,

I'm working on Esm 9.3.2 and I have an issue with Rollout property. When I trying rollout policies to Correlation Engine ,it throw a message somehow as follow:

Correlation Engine (Could not update policy - "Error: Could not connect to device" (Error processing rule: 47-6000001))

I've some tried suggestions as follow; however didn't help

- service cpservice stop

- DBCheck -d '/usr/local/ess/data/ngcp.dfl' -p 'LOCD*******************' -t '!Alert|!Connection|!Log|!Packet|!stringmap' -r

- service cpservice start

Any ideas?

Edited by Moderator

5 Replies
Highlighted

Re: Critical Rollout issue!

any ideas?

Re: Critical Rollout issue!

Remove rule 47-6000001 as it is causing the issues.

Let me know how it goes or in case you need help

Re: Critical Rollout issue!

Excuse me i suppose i had to give you a clue.

This is Custom Correlation rule so under Policy Editor --> Correlation and then filter based on signature id.

That should do the job.

Re: Critical Rollout issue!

Curiously enough, it had already been deleted when I was look Policy Editor --> Correlation Engine,That's why I tried to repair the database. Luckily, this is PoC system and it is not so important I'll keep investigate on it. thnks your effort.

Re: Critical Rollout issue!

Hm... okay then just download and reapply the latest rule updates and see if that makes a difference.

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator