cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
kovarczi
Level 8
Report Inappropriate Content
Message 1 of 10

McAfee Agent 5.6.6.232 communication problems with ePO (only on servers)

Hello guys,

 

we upgraded the Agent to latest release on Windows Servers two weeks ago.

Unfortunately on some servers (<10) the Agent can not communicate with ePO.

A reboot solves the issue, but it is weird.

Mostly on Windows Server 2012 R2.

Other McAfee packages: ENS 10.6 July Update (TP, ATP), MAR 2.4.3 and thats all.

 

Is there anybody who has same issue?

 

Regards,

k

9 Replies
cdinet
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 10

Re: McAfee Agent 5.6.6.232 communication problems with ePO (only on servers)

We would need to see logs, but I suspect the reboot resolves due to syscore being re-applied.  ENS installs syscore drivers, which the agent uses with trusting or not trusting dll's that interact with the agent.  When the agent is upgraded, that changes what syscore trusts, which a reboot resets.  It is not always required, but sometimes it is.

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

kovarczi
Level 8
Report Inappropriate Content
Message 3 of 10

Re: McAfee Agent 5.6.6.232 communication problems with ePO (only on servers)

Hello guys,

 

please see below the logs.

macompatsvc.log

2020-12-02 09:44:50.234 macompatsvc(8656.4028) lpc.Info: Check software exist for software ENDPATP_1060.
2020-12-02 09:44:50.234 macompatsvc(8656.4028) MsgQueue.Info: Posting message to message queue
2020-12-02 09:44:50.250 macompatsvc(8656.4028) lpc.Info: UBP enforcement settings, user first login (0) & Policy flag (0)
2020-12-02 09:44:50.250 macompatsvc(8656.4028) lpc.Info: Enforcing policy through lpc interface for software ENDPATP_1060.
2020-12-02 09:44:50.250 macompatsvc(8656.4028) lpc.Info: Enforcing policy for notification type<1>.
2020-12-02 09:44:50.250 macompatsvc(8656.4028) MsgQueue.Info: Posting message to message queue
2020-12-02 09:44:50.625 macompatsvc(8656.4028) lpc.Info: Notifying software ENDPATP_1060 about the end of policy enforcement.
2020-12-02 09:44:50.625 macompatsvc(8656.4028) MsgQueue.Info: Posting message to message queue.lo

2020-12-02 09:44:50.640 macompatsvc(8656.4028) lpc.Info: Check software exist for software ENDP_AM_1060.
2020-12-02 09:44:50.640 macompatsvc(8656.4028) MsgQueue.Info: Posting message to message queue
2020-12-02 09:44:50.640 macompatsvc(8656.4028) lpc.Info: UBP enforcement settings, user first login (0) & Policy flag (0)
2020-12-02 09:44:50.640 macompatsvc(8656.4028) lpc.Info: Enforcing policy through lpc interface for software ENDP_AM_1060.
2020-12-02 09:44:50.640 macompatsvc(8656.4028) lpc.Info: Enforcing policy for notification type<1>.
2020-12-02 09:44:50.640 macompatsvc(8656.4028) MsgQueue.Info: Posting message to message queue
2020-12-02 09:44:50.640 macompatsvc(8656.10588) lpc_Agent_Info.Info: Agent Info [0] is [1]
2020-12-02 09:44:51.172 macompatsvc(8656.10848) msgbus.Info: Received Timer event to read msgbus config file
2020-12-02 09:44:54.812 macompatsvc(8656.4028) lpc.Info: Notifying software ENDP_AM_1060 about the end of policy enforcement.
2020-12-02 09:44:54.812 macompatsvc(8656.4028) MsgQueue.Info: Posting message to message queue
2020-12-02 09:44:54.812 macompatsvc(8656.4028) lpc.Info: Check software exist for software ENDP_GS_1060.
2020-12-02 09:44:54.812 macompatsvc(8656.4028) MsgQueue.Info: Posting message to message queue
2020-12-02 09:44:54.812 macompatsvc(8656.4028) lpc.Info: UBP enforcement settings, user first login (0) & Policy flag (0)
2020-12-02 09:44:54.812 macompatsvc(8656.4028) lpc.Info: Enforcing policy through lpc interface for software ENDP_GS_1060.
2020-12-02 09:44:54.812 macompatsvc(8656.4028) lpc.Info: Enforcing policy for notification type<1>.
2020-12-02 09:44:54.812 macompatsvc(8656.4028) MsgQueue.Info: Posting message to message queue
2020-12-02 09:44:54.952 macompatsvc(8656.10588) lpc_Agent_Info.Info: Agent Info [0] is [1]
2020-12-02 09:44:54.952 macompatsvc(8656.4028) lpc.Info: Notifying software ENDP_GS_1060 about the end of policy enforcement.
2020-12-02 09:44:54.952 macompatsvc(8656.4028) MsgQueue.Info: Posting message to message queue
2020-12-02 09:44:54.952 macompatsvc(8656.4028) cma.Info: Enforcing the compat service policy.
2020-12-02 09:45:36.432 macompatsvc(8656.5328) lpc_Agent_Info.Info: Agent Info [0] is [1]
2020-12-02 09:46:36.444 macompatsvc(8656.10588) lpc_Agent_Info.Info: Agent Info [0] is [1]
2020-12-02 09:47:36.449 macompatsvc(8656.5328) lpc_Agent_Info.Info: Agent Info [0] is [1]
2020-12-02 09:48:36.455 macompatsvc(8656.10588) lpc_Agent_Info.Info: Agent Info [0] is [1]
2020-12-02 09:49:36.459 macompatsvc(8656.5328) lpc_Agent_Info.Info: Agent Info [0] is [1]
2020-12-02 09:50:36.466 macompatsvc(8656.10588) lpc_Agent_Info.Info: Agent Info [0] is [1]
2020-12-02 09:51:36.468 macompatsvc(8656.5328) lpc_Agent_Info.Info: Agent Info [0] is [1]
2020-12-02 09:52:36.492 macompatsvc(8656.10588) lpc_Agent_Info.Info: Agent Info [0] is [1]
2020-12-02 09:53:36.503 macompatsvc(8656.5328) lpc_Agent_Info.Info: Agent Info [0] is [1]
2020-12-02 09:54:36.509 macompatsvc(8656.10588) lpc_Agent_Info.Info: Agent Info [0] is [1]
2020-12-02 09:54:50.100 macompatsvc(8656.10848) msgbus.Info: File watcher callback invoked on broker config change, file name <config.ini>
2020-12-02 09:54:50.115 macompatsvc(8656.10848) msgbus.Info: File watcher callback invoked on broker config change, file name <config.ini>
2020-12-02 09:54:50.115 macompatsvc(8656.10848) msgbus.Info: File watcher callback invoked on broker config change, file name <config.ini>
2020-12-02 09:54:50.115 macompatsvc(8656.10848) msgbus.Info: File watcher callback invoked on broker config change, file name <config.ini>
2020-12-02 09:54:50.115 macompatsvc(8656.10848) msgbus.Info: File watcher callback invoked on broker config change, file name <config.ini>
2020-12-02 09:54:50.194 macompatsvc(8656.5104) lpc.Info: Check software exist for software ENDPATP_1060.
2020-12-02 09:54:50.194 macompatsvc(8656.5104) MsgQueue.Info: Posting message to message queue
2020-12-02 09:54:50.194 macompatsvc(8656.5104) lpc.Info: UBP enforcement settings, user first login (0) & Policy flag (0)
2020-12-02 09:54:50.194 macompatsvc(8656.5104) lpc.Info: Enforcing policy through lpc interface for software ENDPATP_1060.
2020-12-02 09:54:50.194 macompatsvc(8656.5104) lpc.Info: Enforcing policy for notification type<1>.
2020-12-02 09:54:50.194 macompatsvc(8656.5104) MsgQueue.Info: Posting message to message queue
2020-12-02 09:54:50.585 macompatsvc(8656.5104) lpc.Info: Notifying software ENDPATP_1060 about the end of policy enforcement.
2020-12-02 09:54:50.585 macompatsvc(8656.5104) MsgQueue.Info: Posting message to message queue
2020-12-02 09:54:50.585 macompatsvc(8656.5104) lpc.Info: Check software exist for software ENDP_AM_1060.
2020-12-02 09:54:50.585 macompatsvc(8656.5104) MsgQueue.Info: Posting message to message queue
2020-12-02 09:54:50.585 macompatsvc(8656.5104) lpc.Info: UBP enforcement settings, user first login (0) & Policy flag (0)
2020-12-02 09:54:50.585 macompatsvc(8656.5104) lpc.Info: Enforcing policy through lpc interface for software ENDP_AM_1060.
2020-12-02 09:54:50.585 macompatsvc(8656.5104) lpc.Info: Enforcing policy for notification type<1>.
2020-12-02 09:54:50.585 macompatsvc(8656.5104) MsgQueue.Info: Posting message to message queue
2020-12-02 09:54:50.585 macompatsvc(8656.5328) lpc_Agent_Info.Info: Agent Info [0] is [1]
2020-12-02 09:54:51.132 macompatsvc(8656.10848) msgbus.Info: Received Timer event to read msgbus config file
2020-12-02 09:54:54.772 macompatsvc(8656.5104) lpc.Info: Notifying software ENDP_AM_1060 about the end of policy enforcement.
2020-12-02 09:54:54.772 macompatsvc(8656.5104) MsgQueue.Info: Posting message to message queue
2020-12-02 09:54:54.788 macompatsvc(8656.5104) lpc.Info: Check software exist for software ENDP_GS_1060.
2020-12-02 09:54:54.788 macompatsvc(8656.5104) MsgQueue.Info: Posting message to message queue
2020-12-02 09:54:54.788 macompatsvc(8656.5104) lpc.Info: UBP enforcement settings, user first login (0) & Policy flag (0)
2020-12-02 09:54:54.788 macompatsvc(8656.5104) lpc.Info: Enforcing policy through lpc interface for software ENDP_GS_1060.
2020-12-02 09:54:54.788 macompatsvc(8656.5104) lpc.Info: Enforcing policy for notification type<1>.
2020-12-02 09:54:54.788 macompatsvc(8656.5104) MsgQueue.Info: Posting message to message queue
2020-12-02 09:54:54.913 macompatsvc(8656.5328) lpc_Agent_Info.Info: Agent Info [0] is [1]
2020-12-02 09:54:54.913 macompatsvc(8656.5104) lpc.Info: Notifying software ENDP_GS_1060 about the end of policy enforcement.
2020-12-02 09:54:54.913 macompatsvc(8656.5104) MsgQueue.Info: Posting message to message queue
2020-12-02 09:54:54.913 macompatsvc(8656.5104) cma.Info: Enforcing the compat service policy.
2020-12-02 09:55:03.332 macompatsvc(8656.5104) lpc.Info: Collecting properties through lpc interface for software ENDPATP_1060.
2020-12-02 09:55:03.332 macompatsvc(8656.5104) lpc.Info: Check software exist for software ENDPATP_1060.
2020-12-02 09:55:03.332 macompatsvc(8656.5104) MsgQueue.Info: Posting message to message queue
2020-12-02 09:55:03.332 macompatsvc(8656.5104) MsgQueue.Info: Posting message to message queue
2020-12-02 09:55:03.364 macompatsvc(8656.10588) lpc_Agent_Info.Info: Agent Info [0] is [1]
2020-12-02 09:55:03.364 macompatsvc(8656.12268) lpc.Info: Collecting properties through lpc interface for software ENDP_AM_1060.
2020-12-02 09:55:03.364 macompatsvc(8656.12268) lpc.Info: Check software exist for software ENDP_AM_1060.
2020-12-02 09:55:03.364 macompatsvc(8656.12268) MsgQueue.Info: Posting message to message queue
2020-12-02 09:55:03.364 macompatsvc(8656.5328) lpc_Agent_Info.Info: Agent Info [0] is [1]
2020-12-02 09:55:03.364 macompatsvc(8656.12268) MsgQueue.Info: Posting message to message queue
2020-12-02 09:55:03.395 macompatsvc(8656.10588) lpc_Agent_Info.Info: Agent Info [0] is [1]
2020-12-02 09:55:03.395 macompatsvc(8656.10204) lpc.Info: Collecting properties through lpc interface for software ENDP_GS_1060.
2020-12-02 09:55:03.395 macompatsvc(8656.10204) lpc.Info: Check software exist for software ENDP_GS_1060.
2020-12-02 09:55:03.395 macompatsvc(8656.10204) MsgQueue.Info: Posting message to message queue
2020-12-02 09:55:03.395 macompatsvc(8656.5328) lpc_Agent_Info.Info: Agent Info [0] is [1]
2020-12-02 09:55:03.442 macompatsvc(8656.10204) MsgQueue.Info: Posting message to message queue
2020-12-02 09:55:03.442 macompatsvc(8656.10848) cmasvc.Info: Application DXL_____1000 is installed.
2020-12-02 09:55:03.457 macompatsvc(8656.10848) cmasvc.Error: Insufficient information about the application DXL_____1000.
2020-12-02 09:55:03.457 macompatsvc(8656.10848) cmasvc.Error: Manageability client creation failed for the application DXL_____1000.
2020-12-02 09:55:03.457 macompatsvc(8656.10848) cmasvc.Info: Application MAR_____1000 is installed.
2020-12-02 09:55:03.457 macompatsvc(8656.10848) cmasvc.Error: Insufficient information about the application MAR_____1000.
2020-12-02 09:55:03.457 macompatsvc(8656.10848) cmasvc.Error: Manageability client creation failed for the application MAR_____1000.
2020-12-02 09:55:03.457 macompatsvc(8656.10848) cmasvc.Info: Application DXL_____1000 is installed.
2020-12-02 09:55:03.457 macompatsvc(8656.10848) cmasvc.Error: Insufficient information about the application DXL_____1000.
2020-12-02 09:55:03.457 macompatsvc(8656.10848) cmasvc.Error: Manageability client creation failed for the application DXL_____1000.
2020-12-02 09:55:03.457 macompatsvc(8656.10848) cmasvc.Info: Application MAR_____1000 is installed.
2020-12-02 09:55:03.457 macompatsvc(8656.10848) cmasvc.Error: Insufficient information about the application MAR_____1000.
2020-12-02 09:55:03.457 macompatsvc(8656.10848) cmasvc.Error: Manageability client creation failed for the application MAR_____1000.
2020-12-02 09:55:03.473 macompatsvc(8656.10588) lpc_Agent_Info.Info: Agent Info [0] is [1]
2020-12-02 09:55:36.522 macompatsvc(8656.5328) lpc_Agent_Info.Info: Agent Info [0] is [1]
2020-12-02 09:56:36.520 macompatsvc(8656.10588) lpc_Agent_Info.Info: Agent Info [0] is [1]
2020-12-02 09:57:36.521 macompatsvc(8656.5328) lpc_Agent_Info.Info: Agent Info [0] is [1]
2020-12-02 09:57:48.656 macompatsvc(8656.10848) cmasvc.Info: Application DXL_____1000 is installed.
2020-12-02 09:57:48.656 macompatsvc(8656.10848) cmasvc.Error: Insufficient information about the application DXL_____1000.
2020-12-02 09:57:48.656 macompatsvc(8656.10848) cmasvc.Error: Manageability client creation failed for the application DXL_____1000.
2020-12-02 09:57:48.656 macompatsvc(8656.10848) cmasvc.Info: Application MAR_____1000 is installed.
2020-12-02 09:57:48.656 macompatsvc(8656.10848) cmasvc.Error: Insufficient information about the application MAR_____1000.
2020-12-02 09:57:48.656 macompatsvc(8656.10848) cmasvc.Error: Manageability client creation failed for the application MAR_____1000.
2020-12-02 09:57:48.656 macompatsvc(8656.10848) cmasvc.Info: Application DXL_____1000 is installed.
2020-12-02 09:57:48.656 macompatsvc(8656.10848) cmasvc.Error: Insufficient information about the application DXL_____1000.
2020-12-02 09:57:48.656 macompatsvc(8656.10848) cmasvc.Error: Manageability client creation failed for the application DXL_____1000.
2020-12-02 09:57:48.656 macompatsvc(8656.10848) cmasvc.Info: Application MAR_____1000 is installed.
2020-12-02 09:57:48.656 macompatsvc(8656.10848) cmasvc.Error: Insufficient information about the application MAR_____1000.
2020-12-02 09:57:48.656 macompatsvc(8656.10848) cmasvc.Error: Manageability client creation failed for the application MAR_____1000.
2020-12-02 09:57:48.672 macompatsvc(8656.8364) LpcConnMgr.Info: Processing health check request
2020-12-02 09:57:48.672 macompatsvc(8656.8364) MsgQueue.Info: Running garbage collection
2020-12-02 09:57:48.672 macompatsvc(8656.8364) MsgQueue.Info: Adding channel for message queue 1496913389 extended software id hash 474185642 client id 194087248
2020-12-02 09:57:48.672 macompatsvc(8656.8364) MsgQueue.Info: Channel added to message queue successfully
2020-12-02 09:57:48.672 macompatsvc(8656.8364) LPC.Info: Registering new LPC process
2020-12-02 09:57:48.672 macompatsvc(8656.8364) LPC.Info: Successfully registered new LPC process, CMNUPD__3000:DEFAULT:11988
2020-12-02 09:58:11.178 macompatsvc(8656.8364) LpcConnMgr.Info: Processing message queue disconnection request
2020-12-02 09:58:11.178 macompatsvc(8656.8364) LPC.Info: Unregistering LPC process
2020-12-02 09:58:11.178 macompatsvc(8656.8364) LPC.Info: Successfully unregistered LPC process, CMNUPD__3000:DEFAULT:11988
2020-12-02 09:58:36.534 macompatsvc(8656.10588) lpc_Agent_Info.Info: Agent Info [0] is [1]
2020-12-02 09:59:36.531 macompatsvc(8656.5328) lpc_Agent_Info.Info: Agent Info [0] is [1]
2020-12-02 10:00:36.539 macompatsvc(8656.10588) lpc_Agent_Info.Info: Agent Info [0] is [1]
2020-12-02 10:01:36.545 macompatsvc(8656.5328) lpc_Agent_Info.Info: Agent Info [0] is [1]
2020-12-02 10:02:36.544 macompatsvc(8656.10588) lpc_Agent_Info.Info: Agent Info [0] is [1]
2020-12-02 10:03:36.555 macompatsvc(8656.5328) lpc_Agent_Info.Info: Agent Info [0] is [1]
2020-12-02 10:04:36.560 macompatsvc(8656.10588) lpc_Agent_Info.Info: Agent Info [0] is [1]

masvc.log

2020-12-02 09:55:41.836 masvc(9228.308) ahclient.Info: Agent is connecting to ePO server
2020-12-02 09:55:41.836 masvc(9228.308) ahclient.Info: Initiating spipe connection to site https://ip:port/spipe/pkg?AgentGuid={f242810a-3e49-11e8-3e07-001dd8b71cd0}&Source=Agent_3.0.0.
2020-12-02 09:55:41.836 masvc(9228.308) ahclient.Info: connection initiated to site https://ip:port/spipe/pkg?AgentGuid={f242810a-3e49-11e8-3e07-001dd8b71cd0}&Source=Agent_3.0.0.
2020-12-02 09:55:41.836 masvc(9228.308) event.Info: Agent is looking for events to upload
2020-12-02 09:55:41.836 masvc(9228.308) event.Info: Agent did not find any events to upload
2020-12-02 09:55:41.939 masvc(9228.308) ahclient.Info: Network library rc = <1008>, Agent handler reports response code <200>.
2020-12-02 09:55:41.939 masvc(9228.308) ahclient.Info: Agent handler reports spipe package received. response code 200.
2020-12-02 09:55:41.939 masvc(9228.308) ahclient.Info: Spipe connection response received, network return code = 1008, response code 200.
2020-12-02 09:55:41.939 masvc(9228.308) policy.Info: Agent received POLICY package from ePO server
2020-12-02 09:55:42.004 masvc(9228.308) ahclient.Info: Agent communication session closed
2020-12-02 09:55:42.004 masvc(9228.308) ioservice.Info: IO service received the message.
2020-12-02 09:55:42.019 masvc(9228.308) ioservice.Info: IO service received the message.
2020-12-02 09:55:42.169 masvc(9228.308) ioservice.Info: Refreshed the policy bag.
2020-12-02 09:55:42.190 masvc(9228.308) ioservice.Info: IO service received the message.
2020-12-02 09:57:46.555 masvc(9228.308) Updater.Info: Received updater request initiator_type=0 request_type=0 taskid={7270c5b4-347c-11eb-0e9b-64da80dc1a89}.
2020-12-02 09:57:46.555 masvc(9228.308) Updater.Info: Creating on Demand updater request, task id = {7270c5b4-347c-11eb-0e9b-64da80dc1a89}.
2020-12-02 09:57:46.555 masvc(9228.308) Updater.Info: Adding the updater request taskid <{7270c5b4-347c-11eb-0e9b-64da80dc1a89}> in the queue.
2020-12-02 09:57:47.563 masvc(9228.308) Updater.Info: Invoking mue as, [C:\Program Files\McAfee\Agent\x86\McScript_InUse.exe -script C:\ProgramData\McAfee\Agent\update\UpdateMain.McS -id 22800 -localeid 0409 -logfile C:\ProgramData\McAfee\Agent\logs\McScript -parent FRAMEWORK -initiator 0 -installdir C:\Program Files\McAfee\Agent\\x86\ -taskid {7270c5b4-347c-11eb-0e9b-64da80dc1a89} (null) ].
2020-12-02 09:57:47.625 masvc(9228.308) Updater.Info: Updater engine is spawned successfully.
2020-12-02 09:57:47.625 masvc(9228.308) Updater.Info: Creating mue event handler.
2020-12-02 09:57:47.625 masvc(9228.308) Updater.Info: Created mue event handler.
2020-12-02 09:57:47.625 masvc(9228.308) Updater.Info: Launched updater engine successfully.
2020-12-02 09:57:47.625 masvc(9228.308) Updater.Info: Updater session started for initiator type=0, task id = <{7270c5b4-347c-11eb-0e9b-64da80dc1a89}>.
2020-12-02 09:57:48.313 masvc(9228.308) msgbus.Info: QueryFullProcessImageName C:\Program Files\McAfee\Agent\x86\McScript_InUse.exe
2020-12-02 09:57:48.328 masvc(9228.308) msgbus.Info: verify code signature returns <0>, GetLastError <0>.
2020-12-02 09:57:48.344 masvc(9228.308) msgbus.Info: Adding <C:\Program Files\McAfee\Agent\x86\McScript_InUse.exe>:<11988> auth info reference
2020-12-02 09:57:48.344 masvc(9228.308) msgbus.Info: executable <C:\Program Files\McAfee\Agent\x86\McScript_InUse.exe> is trusted via authenticode. Signer: <McAfee, Inc.> Issuer: <GlobalSign CodeSigning CA - G3>
2020-12-02 09:57:48.344 masvc(9228.308) msgbus.Info: Allowing <11988> onto msgbus
2020-12-02 09:57:48.656 masvc(9228.308) compatservice.Info: Received notifications for changes on backcompat watcher
2020-12-02 09:57:48.656 masvc(9228.308) compatservice.Info: is_compat_running: 1, is_compat_required: 1

 

cdinet
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 4 of 10

Re: McAfee Agent 5.6.6.232 communication problems with ePO (only on servers)

I don't see failures.  Was that after reboot?  If so, check logs before reboot for failures.  Also, the mfemactl log will show if there are any syscore injection issues.

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

cdinet
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 5 of 10

Re: McAfee Agent 5.6.6.232 communication problems with ePO (only on servers)

Here are some additional notes for communication issues.  You need to look at both sides of the conversation - server and client side, checking masvc log to see which epo server or agent handler that the client is trying to talk to.  There are 2 basic failure types.  Either agent reaches server and it fails from there, or the agent never even reaches the server.  In the former scenario, there should be entries related in the server log.

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

kovarczi
Level 8
Report Inappropriate Content
Message 6 of 10

Re: McAfee Agent 5.6.6.232 communication problems with ePO (only on servers)

No, we are before restart.

mfemactl.log

2020-12-02 14:06:15.040 mfemactl(5960.7552) mfemactl.Info: The process <C:\WINDOWS\SYSTEM32\SVCHOST.EXE>(704) was blocked from accessing('WRITE, DELETE' (a)) <AAC_OBJECT_PROCESS:C:\PROGRAM FILES\MCAFEE\AGENT\X86\UPDATERUI.EXE> via the rule <Protect MA Processes>
2020-12-02 14:06:15.040 mfemactl(5960.7552) mfemactl.Info: The process <C:\WINDOWS\SYSTEM32\SVCHOST.EXE>(704) was blocked from accessing('WRITE, DELETE' (a)) <AAC_OBJECT_PROCESS:C:\PROGRAM FILES\MCAFEE\AGENT\X86\MCTRAY.EXE> via the rule <Protect MA Processes>
2020-12-02 14:06:15.040 mfemactl(5960.7552) mfemactl.Info: The process <C:\WINDOWS\SYSTEM32\SVCHOST.EXE>(704) was blocked from accessing('WRITE, DELETE' (a)) <AAC_OBJECT_PROCESS:C:\PROGRAM FILES\MCAFEE\AGENT\MACMNSVC.EXE> via the rule <Protect MA Processes>
2020-12-02 14:06:15.040 mfemactl(5960.7552) mfemactl.Info: The process <C:\WINDOWS\SYSTEM32\SVCHOST.EXE>(704) was blocked from accessing('WRITE, DELETE' (a)) <AAC_OBJECT_PROCESS:C:\PROGRAM FILES\MCAFEE\AGENT\MASVC.EXE> via the rule <Protect MA Processes>
2020-12-02 14:06:15.040 mfemactl(5960.7552) mfemactl.Info: The process <C:\WINDOWS\SYSTEM32\SVCHOST.EXE>(704) was blocked from accessing('WRITE, DELETE' (a)) <AAC_OBJECT_PROCESS:C:\PROGRAM FILES\MCAFEE\AGENT\X86\MACOMPATSVC.EXE> via the rule <Protect MA Processes>
2020-12-02 14:06:15.040 mfemactl(5960.7552) mfemactl.Info: The process <C:\WINDOWS\SYSTEM32\SVCHOST.EXE>(704) was blocked from accessing('WRITE, DELETE' (a)) <AAC_OBJECT_PROCESS:C:\PROGRAM FILES\MCAFEE\AGENT\X86\MFEMACTL.EXE> via the rule <Protect MA Processes>
2020-12-02 14:06:15.040 mfemactl(5960.7552) mfemactl.Info: The process <C:\WINDOWS\SYSTEM32\SVCHOST.EXE>(704) was blocked from accessing('WRITE, DELETE' (a)) <AAC_OBJECT_PROCESS:C:\PROGRAM FILES\MCAFEE\AGENT\X86\UPDATERUI.EXE> via the rule <Protect MA Processes>
2020-12-02 14:06:15.040 mfemactl(5960.7552) mfemactl.Info: The process <C:\WINDOWS\SYSTEM32\SVCHOST.EXE>(704) was blocked from accessing('WRITE, DELETE' (a)) <AAC_OBJECT_PROCESS:C:\PROGRAM FILES\MCAFEE\AGENT\X86\MCTRAY.EXE> via the rule <Protect MA Processes>
2020-12-02 14:06:15.040 mfemactl(5960.6508) mfemactl.Info: The process <C:\WINDOWS\SYSTEM32\SVCHOST.EXE>(704) was blocked from accessing('WRITE, DELETE' (a)) <AAC_OBJECT_PROCESS:C:\PROGRAM FILES\MCAFEE\AGENT\X86\MFEMACTL.EXE> via the rule <Protect MA Processes>
2020-12-02 14:06:15.040 mfemactl(5960.1768) mfemactl.Info: The process <C:\WINDOWS\SYSTEM32\SVCHOST.EXE>(704) was blocked from accessing('WRITE, DELETE' (a)) <AAC_OBJECT_PROCESS:C:\PROGRAM FILES\MCAFEE\AGENT\MACMNSVC.EXE> via the rule <Protect MA Processes>
2020-12-02 14:06:15.040 mfemactl(5960.11004) mfemactl.Info: The process <C:\WINDOWS\SYSTEM32\SVCHOST.EXE>(704) was blocked from accessing('WRITE, DELETE' (a)) <AAC_OBJECT_PROCESS:C:\PROGRAM FILES\MCAFEE\AGENT\MASVC.EXE> via the rule <Protect MA Processes>

There are no any line regarding these IPs.

Thats weird btw bacause the Agent services are healthy on servers, but the last line on Agent Status monitor was 9:55 AM.

 

Regards,

k

 

cdinet
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 7 of 10

Re: McAfee Agent 5.6.6.232 communication problems with ePO (only on servers)

If you wait a short time after install completes, does the log start logging again?  Do the Windows event logs show any application hang, crash, fault or anything else?  Service may be running, but hung.  I would suggest opening ticket with McAfee with mer from unfixed system and possibly get a process dump from masvc with corresponding mer when it is in that state (you would need to disable self protection first, which may be difficult to do if agent isn't communicating).  

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

kovarczi
Level 8
Report Inappropriate Content
Message 8 of 10

Re: McAfee Agent 5.6.6.232 communication problems with ePO (only on servers)

I create a Service Ticket, of course.

This issue is occured not after upgrade, but two weeks later, which is so weird. The first server stop communicate last friday.

 

Thanks a lot.

 

Regards,

k

kovarczi
Level 8
Report Inappropriate Content
Message 9 of 10

Re: McAfee Agent 5.6.6.232 communication problems with ePO (only on servers)

Unfortunately we have a server which was rebooted after Agent instalallation. And the issue occured today. Weird, we don't see any error in logs.

cdinet
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 10 of 10

Re: McAfee Agent 5.6.6.232 communication problems with ePO (only on servers)

If you opened a ticket, please work with that since this would require log analysis.  

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community