Since updating the McAfee EPO Agent to 22.214.171.124. on some servers we are seeing lots of event log entries these are happening several times per minute and continue after reboots
Event ID 1
Source McAfee Service Controller
The mfevtp MMS Service entered the running state.
anyone else seen these entries.?
I'm seeing the same thing on some desktops as well. If I figure out the cause and/or fix, I will re-post. Likewise, if anyone else already knows the cause/fix, please post.
It sounds like the service must not be starting successfully, and retries... only to fail.
Two things come to mind as the possible cause -
1. It fails to start because a 3rd party intrusive application is present, and injecting our process, consequently causing the process to become Untrusted, and when performing a self-validation check it determines it has been compromised and quits.
2. The issue explained in #1 occurred, the result "Untrusted" was then cached, and even if you no longer have the intrusive application it still fails because the self-validation check is reading the cached result.
If you open an administrative CMD window, and navigate to \Program Files\Common Files\McAfee\SystemCore, run the VTPINFO.exe with the following switch and see if it magically fixes it:
If it does solve it, do share.
If it does not, I suggest engaging with Support because the reason for the behavior will not be due to reasons #1 or #2 that I've described, and will require more work to figure it out.
Bill - It does seem to have reduced it a bit. Before resetting VTPINFO, I was about 90 events over 24 hours. Since resetting VTPINFO, I'm getting about 28 events. The root issue I was chasing ended up not having anything to do with this, but wanted to post back in case anyone else comes across this thread. Thanks again!
Same issue here across multiple Servers. Logged a Ticket, but still no response.
This is an issue for us here a "other" monitoring continues to pickup these events.
robg3381. What was your fix ?