McAfee Agent 5.0.5.739 Application Error on shutdown

[PhilR]

Agent 5.0.6.220 has been released to McAfee Downloads site and fixes this issue.

Cheers,

Phil

[brentil]

Additional confirmation that 5.0.6.220 has resolved this issue for us as well too.

[ISmith]

I am seeing this error on Startup on MA 5.6.10.940 and 5.6.1.157

[cdinet]

What is the specific error in the event logs?  If you also match the time frame in the masvc log, is there anything going on at the time with the agent?  What OS build is this?

[ISmith]

I am going to add a support case the next time I see it.

I have seen this on Win 10 1803 and 1709 and it happens shortly after startup.

Error prompt: "The application was unable to start correctly (0xc0000018). Click OK to close the application."

Error in system event log says the exact same thing.

There is nothing in the application event log.

On this machine I updated the agent from 5.6.0.940 to 5.6.1.157 after seeing the error and so the masvc log file appears to have been overwritten and the earliest date is later than the error.

[cdinet]

Ok, if it occurs again and you open a ticket, send me case number in private message please.

[ISmith]

I may open a case this morning since I have now seen it again.

I now have the masvc log and it connected to the EPO server (response code 200) and received a policy pkg, enforced policies.

Then (X2) "scheduler service.Critical: schedule get task request failed, last error(1101)"

Then (X2) "scheduler service.Critical: schedule delete task request failed, last error(1101)"

Then it connects to EPO again (response 200) uploads package successfully, receives a message and 

Then (X2) "scheduler service.Critical: schedule get task request failed, last error(1101)"

Looks for events to upload, finds 3, connects to EPO: 

Wait 20 seconds

Then network.Notice URL(epo/spipe/pkg?agentguid=...) request failed with curl error <7>, response <0>, http connect <0>

It shows a stack trace. and after that a few messages about failing to resolve host.

Before I open a ticket I am going to speak with my network team.

[cdinet]

What exact build of the agent are you running on that?  A stack trace indicates a crash of the service somewhere.

[ISmith]

MAgent 5.6.1.157.

This machine was on VPN at the time so I am trying to verify that the network did not actually go down during this time frame.

The stack trace is not a traditional code trace, this appears to be a network output from curl:

[Stack Trace START]
[2019-06-20 07:29:48.431 curl text 22 Closing connection 36 ]
[2019-06-20 07:29:48.431 curl text 52 Failed to connect to 10.X.X.X port 443: Timed out ]
[2019-06-20 07:29:48.431 curl text 49 connect to 10.X.X.X port 443 failed: Timed out ]
[2019-06-20 07:29:27.390 curl text 16 TCP_NODELAY set ]
[2019-06-20 07:29:27.390 curl text 23 Trying 10.X.X.X... ]
[2019-06-20 07:29:27.390 curl text 43 Hostname 10.X.X.X was found in DNS cache ]
[2019-06-20 07:29:27.390 curl text 22 Closing connection 35 ]
[2019-06-20 07:29:27.390 curl text 32 Connection 35 seems to be dead! ]
[2019-06-20 07:28:52.908 curl text 46 Connection #35 to host 10.X.X.X left intact ]
[2019-06-20 07:28:52.908 curl rcv head 2 ]
[2019-06-20 07:28:52.908 curl rcv head 40 Content-Type: application/octet-stream ]
[2019-06-20 07:28:52.908 curl rcv head 21 Content-Length: 893 ]
[2019-06-20 07:28:52.908 curl rcv head 64 Strict-Transport-Security: max-age=31536000; includeSubDomains ]
[2019-06-20 07:28:52.908 curl rcv head 16 Server: Apache ]
[2019-06-20 07:28:52.908 curl rcv head 37 Date: Thu, 20 Jun 2019 11:28:52 GMT ]
[2019-06-20 07:28:52.908 curl rcv head 17 HTTP/1.1 200 OK ]
[2019-06-20 07:28:52.453 curl text 36 We are completely uploaded and fine ]
[2019-06-20 07:28:52.453 curl rcv head 23 HTTP/1.1 100 Continue ]
[2019-06-20 07:28:52.392 curl snd head 327 POST /spipe/pkg?AgentGuid={...}&Source=Agent_3.0.0 HTTP/1.1 Host: 10.X.X.X User-Agent: Mozilla/4.0 (compatible; SPIPE/3.0; Windows) McAfee Agent Accept: application/octet-stream Accept-Language: en-us C]
[2019-06-20 07:28:52.392 curl text 52 Connected to 10.X.X.X (10.X.X.X) port 443 (#35) ]
[2019-06-20 07:28:52.392 curl text 57 Re-using existing connection! (#35) with host 10.X.X.X ]
[2019-06-20 07:28:52.392 curl text 59 Found bundle for host 10.X.X.X: 0x1f89a20 [can pipeline] ]
[2019-06-20 07:28:47.099 curl text 46 Connection #35 to host 10.X.X.X left intact ]
[2019-06-20 07:28:47.099 curl rcv head 2 ]
[2019-06-20 07:28:47.099 curl rcv head 40 Content-Type: application/octet-stream ]
[2019-06-20 07:28:47.099 curl rcv head 22 Content-Length: 4496 ]
[2019-06-20 07:28:47.099 curl rcv head 64 Strict-Transport-Security: max-age=31536000; includeSubDomains ]
[2019-06-20 07:28:47.099 curl rcv head 16 Server: Apache ]
[2019-06-20 07:28:47.099 curl rcv head 37 Date: Thu, 20 Jun 2019 11:28:47 GMT ]
[2019-06-20 07:28:47.099 curl rcv head 17 HTTP/1.1 200 OK ]
[Stack Trace END]

[cdinet]

Ok, yes, that does look like a network timeout.