Another Agent unable to connect to EPO

[tauhs]

Try accessing this

C:\ProgramData\McAfee\Common Framework

[tauhs]

That particular area that you posted shows the local agent on that machine. If you scroll all the way to the bottom you will see UdaterUI.exe if you double click that it will force the red "M" shield into your start menu options (the ^ arrow at the bottom of your screen) From there you can right click the shield and open info about installed products, update, or open the "McAfee Agent Status Monitor" but that is local only.

However....you CAN do something like that without using RDP and interrupting users. (this is NOT a massive solution, but it does help fix that PITA ones that just wont update. This is one at a time solution.

Open a CMD.exe screen

you will need the install path on the machine your trying to fix....to access the users folders go to \\<IP or system name>\c$

open -  C:\Program Files (x86)\McAfee\Common Framework now Highlight and copy that entire string

Make sure you are at the root directory C:\ and paste into the CMD screen using right click and paste so you see CD  \\<IP or system name>\Program Files (x86)\McAfee\Common Framework

From here type CmdAgent.exe /P and enter

This will run the McAfee Agent Status Monitor on the machine you wacked into without the user being interrupted by the popup. It forces the local machine to reach out to ePO  looking for a connection/update.

[tauhs]

Open a CMD.exe screen

you will need the install path on the machine your trying to fix....to access the users folders go to \\<IP or system name>\c$

open -  C:\Program Files (x86)\McAfee\Common Framework now Highlight and copy that entire string

Make sure you are at the root directory C:\ and paste into the CMD screen using right click and paste so you see

CD  \\xx.xxx.1.40\c$\Program Files (x86)\McAfee\Common Framework (enter)

(changed for privay)

From here type CmdAgent.exe /P   (enter)

[tauhs]

I was assuming a Windows 7 or 8 environment, if not.. look here for Agent events

Events are generated by the point product, passed to the McAfee Agent, and held in the Agent events folder. The event file is held there to be uploaded to the ePO server at the next ASCI if the event is of a low priority. Or, it is uploaded immediately if the event is of a high enough severity, and the McAfee Agent policy has the “Enable immediate uploading” option enabled. The Agent events folder is located under the Agent directory structure, which differs depending on operating system:

1. For Windows 7 / Windows 2008 or later:  C:\ProgramData\McAfee\Common Framework\AgentEvents\
2. For Windows before Windows 7: C:\Documents and Settings\All Users\Application Data\Network Associates\Common Framework\AgentEvents\
3. For Linux, WebShield, and Secure Content Management appliances: /opt/NETAepoagt/scratch/AgentDB/Event
4. For Mac OS X: <Macintosh Hard drive>\Library\NETAepoagt\scratch\AgentDB\Event

[scottgilliland2]

my machine is now reporting the failed to communicate error again!  So its definitely and intermittent issue now.

I don't mind the other machines at moment not being monitored as I would rather get what is running the agent connected and then worry about the rest.

any ideas from logs on why it is failing to connect to epo server?

[ansarias]

I request to navigate DB folder and collect McAfee Agent log file to get more error codes.

File Name : Agent_MachineName.log

[scottgilliland2]

attached

[ansarias]

Could you please share ePO version and Agent version on affection machines.

Also confirm If  IPv6 on the ePO server is enabled

[scottgilliland2]

ePO 5.1 and agent version 4.8.0.1500

IPv6 is also enabled

[ansarias]

Than I'll suggest to follow below 2 McAfee KB article based on error codes in McAfee Agent log file :

1.

2015-02-09 18:12:14.356 e #1232 Agent Agent failed to communicate with ePO Server

2015-02-09 18:12:14.356 i #1232 Agent Agent communication session closed

2015-02-09 18:12:14.358 I #1232 Agent Agent data channel communication failed, result=-2400

2015-02-09 18:12:14.358 I #1232 Agent Retry (data channel) in 10 seconds, error=-2400(Connection refused)

2015-02-09 18:12:14.358 i #1232 Agent Agent will connect to the ePO Server in 0 minutes and 10 seconds.

https://kc.mcafee.com/corporate/index?page=content&id=KB73383

2.

2015-02-10 08:48:21.188 i #5920 Agent Agent communication session started

2015-02-10 08:48:21.188 i #5920 Agent Agent is sending FULL PROPS package to ePO server

2015-02-10 08:48:21.188 i #5920 Agent Agent is connecting to ePO server

2015-02-10 08:48:21.194 I #5920 imutils Trying with site: 192.96.48.22:8888

2015-02-10 08:48:21.194 I #5920 naInet HTTP Session initialized

2015-02-10 08:48:21.194 I #5920 imsite  Upload from: C:\ProgramData\McAfee\Common Framework\Unpack\pkg00130680317011600000_2660111167.spkg

2015-02-10 08:48:21.194 I #5920 imsite  Upload response target: C:\ProgramData\McAfee\Common Framework\Unpack\pkg00130680317011880000_682849644.spkg

2015-02-10 08:48:21.292 I #1232 imsite NaInet library returned code == 13

2015-02-10 08:48:21.292 I #1232 naInet HTTP Session closed

https://kc.mcafee.com/corporate/index?page=content&id=KB72227

Before checking above 2 solutions, Try to reinstall McAfee Agent on one affected machine with /forceinstall command and see If it communicates to ePO console or not.