VSE 8.8 Patch 5 - coming soon...

[wwarren]

I think it odd to see comments still being added to the Patch 4 post () but it's time to start one for Patch 5 .

In the same spirit of giving everyone a Heads Up on what to expect with Patch 5, to preempt some questions where possible and help you prepare for what is to come...

Dates are firm but fluid; if they change it'll be in the interest of quality -

Limited availability*: Jan 29

General availability: Feb 26

* Select customers only; the managed release or RTS period, during which the SEO team are closely monitoring the patch's performance/acceptance, thus not open to all customers.

Some points from the prior posting about Patch 4 remain true for Patch 5, those are:

Patch [5] will not install on top of the original "release to world" version of VSE 8.8. Neither will it install on top of VSE 8.8 Patch 1 on x64 systems.

Something not Patch [5] related but it's worth mentioning since Patch [5] contributes to the "problem"...

Environments that install VirusScan and then Patch VirusScan, and/or add Hotfixes to VirusScan, and who DO NOT REBOOT afterwards, are at a growing risk of encountering a BSOD from Stack Exhaustion. It's not our fault, not exactly - we simply didn't expect environments would make 3 or 5 upgrades to our kernel components and NEVER reboot. We allow for it to happen, so that's our fault. And it's technically feasible to do it - a feat not many vendors can claim, that we can update kernel level code without having to force an immediate reboot. However, the OS can only handle doing this so many times before a code execution path exhausts the the Stack of a thread. Therefore I implore you, after patching or hotfixing our kernel drivers, please plan a maintenance window to reboot the box.  A reboot is not required, but if you do not, and you install 'x' number of Patch/Hotfix releases and STILL NO REBOOT, then you will eventually be FORCED to reboot because the system will crash!  Then of course, you don't have to reboot, the BSOD satisfies any need for reboot - you might appreciate it better if it was planned.

Similar but different from Patch 4:

The full install package (when we repost the installation files so that they include Patch 5) will include the 5700 Engine

Patch 4 contained a fix to a specific issue that contributed to the DAT 0000 symptom. Patch 5 contains a related fix also, which allows a system in the DAT 0000 state to self correct on next update.

Unique to Patch 5:

1. MD5 hashes for detections made by the On Access scanner and On Demand scanner will be logged locally to their respective log files. The MD5 hash info is not provided to ePO at this time (it's a larger effort to update the alerting infrastructure to support this addition).
2. Adds support for Threat Intelligence Exchange, a new technology (purchased separately). Patch 5 allows VSE to participate in that technology (replacing HF929019)
3. Solutions to issues that were introduced with Patch 4 ("Thanks Patch 4"), which include -
   • A compatibility issue with Microsoft DirectAccess, and other IPSec dependent features of MS Windows
   • Random hangs on startup but only after applying a Microsoft update
   • Outlook crashing if EmailScan is enabled and you have large calendar data stores
   • BSOD, bugcheck 50 occurring randomly but only on very busy systems
   • Compatibility issue with 3rd party applications that monitor file changes, which caused them to use high CPU
   • On Demand Scan performance tanked hard after installing Patch 4
4. SYSCore 15.3.x build of core driver binaries. "Well now, 15.3, that's impressive... isn't it?"  Yes, but it also means more work for you, probably. Read my blog post:, then see how excited you are .

My recommendation:

Item iii. identifies key reasons why I would recommend Patch 5 for all environments (plus the carrying forward of improvements over older patches).

Item iv. touches on why I feel the patch should be tested thoroughly before wide distribution in any environment.

And as with any patch release, keep an eye out for updates being posted to our Known Issues article specific to the release. It's not posted yet but Patch 5's Known Issues article will be KB81381.

NOTE:  Windows 10 is not supported with Patch 5 (that will be a goal of Patch 6).

[D-Fens]

This is one of the best posts I have ever read in an software product forum.

I feel very informed, excellent job!!

[rmetzger]

Thanks, William.

I agree with D-Fens and hope that the development team is able to keep to the schedule. (I know that is not guaranteed or expected, but I can Hope.)

When the full Repost is posted, will McAfee Installation Designer be released at the same time?

Thanks,

Ron Metzger

[wwarren]

MID is not changing in this release so will remain the same. You'll be able to use the current posted MID if you have need to customize the Patch 5 install package.

You are probably already aware but when choosing source files for MID to use, choose our latest full install package and not one that has been modified prior or is an older patch level and the plan was to add in the MSP. MID creates a new .msi file, and keeping that as simple as possible can avoid migration headaches in the future since that .msi file becomes the foundation for any future patches or version upgrades.

I like your optimism Ron. If we have to break the news of changing dates at all I'll try and be gentle. There is always hope .

[rmetzger]

wwarren wrote:

MID is not changing in this release so will remain the same. You'll be able to use the current posted MID if you have need to customize the Patch 5 install package.
You are probably already aware but when choosing source files for MID to use, choose our latest full install package and not one that has been modified prior or is an older patch level and the plan was to add in the MSP. MID creates a new .msi file, and keeping that as simple as possible can avoid migration headaches in the future since that .msi file becomes the foundation for any future patches or version upgrades.

I like your optimism Ron. If we have to break the news of changing dates at all I'll try and be gentle. There is always hope .

Thanks William,

Wow, no need for a new MID! Cool. I kind of expected with the significant changes that a new MID for VSE 8.8 would be needed. Great. Yes, I am aware of that using the Full Install Package (repost) is needed when creating a new release. I have been doing this, this way, for years.

Thanks,

Ron Metzger

[wwarren]

Just a quick note to break the ice -

Patch 5 dates previously mentioned are changing. Our internal deployment of the patch exposed an issue meriting a fix, and the fix needs to be made in our core driver code (which unfortunately carries a large cost for retesting).

I'll update us with new dates once they've been confirmed.

[zeb]

Thank you William, as always..great info and well written.

Zeb

[D-Fens]

Hi, what will be the new release date? Thanks

[wwarren]

We've been working toward these new dates:

Limited availability*: Mar 12

General availability: Apr 09

* Select customers only; the managed release or RTS period, during which the SEO team are closely monitoring the patch's performance/acceptance, thus not open to all customers.

But I share that knowing well the date may change depending on the outcome of an internal investigation for an odd behavior we're still seeking to understand. If anyone asks though, those are the dates to convey... until they're not .

A few additions worth noting since the original post -

• Regarding the DAT 0000 issue, Patch 5 will also include "DAT rollback" for the scenario where a DAT update results in bad DATs that would normally incur the DAT 0000 symptom - instead, VSE will rollback the DAT so the system remains protected. It will retry the update at the next scheduled time. We've enabled this logic to exercise up to 3 times consecutively. I expect to be updating the relevant KB article with more details about this behavior after Patch 5 is released.
• We solved an interoperability issue involving our own Data Loss Prevention software and MS Outlook, where the mail client would hang on mail receipt.
• We solved a timing issue affecting Windows Action Center's awareness of VSE's state, i.e. we'd be enabled but WAC thought we were disabled (we've addressed a symptom like this before but it made another appearance with Patch 4)

[wwarren]

Took a week off (still off today actually, back tomorrow) but noticed some new unofficial dates being discussed for our Patch 5 release. Unfortunately that means the March 12 and April 9 dates are no more. I'll catch up on the details later but wanted to give folks the heads up.