Rogue System Detection policies are not working on ePO 5.3.3

[mr54]

Hello,

We want to use McAfee RSD on ePO 5.3.3 but it's not working.

The extention was installed without any problem, but when we want edit or use a policy, that says "An unexpected error occurred."

The version is RSD 5.0.6.123

RSD is also installed on our ePO 5.10 and works well, but we absolutely have to install rogue sensor on the 5.3.3 version.

We also tried to import policies from ePO 5.10 and apply on ePO 5.3.3, but it didn't work either.

Thanks for the support.

McAfee ePolicy Orchestrator#RSD

[cdinet]

ePO 5.3 reached end of life March of this year. I would advise first removing the extension, then upgrading epo. You can check it back in after that, but you don't want to upgrade epo with any issues with an extension.

[mr54]

There is any other solution that upgrading ePO ?

[cdinet]

The only support provided for an end of life product is assistance upgrading it. You can try removing the extension and checking it back in if you want, to see if it fixes anything. If you do, disable policy and task retention first so it removes any possible policies causing the unexpected errors. After you check it back in, if you still get the same errors, you can see if additional logging might point you to something. Be sure to not leave that enabled after you get any info needed. logging unexpected errors. First do this: 1- Edit server\conf\orion\orion.properties 2- Replace 'orion.exception.show.detail=false' with 'orion.exception.show.detail=true' 3- Restart Tomcat Then reproduce the issue. Instead of "unexpected error" the console should give you a jstack trace.

[cdinet]

One additional thing you want to look at. In epo console, software, extensions, does the RSD extension show "running" or does it show anything like missing dependencies, shows in red or status is not running?

[mr54]

The RSD extension shows "running", like all the others

[cdinet]

Did you enable the extra logging per instructions I sent you? If so, what is the error that is shown in the Orion log when you duplicate issue?

[cdinet]

Also, did you previously have RSD checked in with a different version? What I would suggest, if the logging doesn't show anything useful, is to go to server settings, policy and task retention and ensure that is disabled. Remove the RSD extension, then re-check it back in and see if issue persists. If not, then go back to server settings and enable policy and task retention.