Showing results for 
Search instead for 
Did you mean: 

CMA is uploading events, but not deleting them

hello forum,

I have a problem with different CMAs, but only if they are behind our firewalls in different locations worldwide. all clients are managed by the ePO-server in our headquarter and they are also uploading their events to it.

agents are uploading their events, BUT I can see these entries in the FrameSvc-LOG-file:

20080610231431 I #3996 InetMgr Uploading package to ePO Server...trial 6 / 6
20080610231431 I #3996 InetMgr Uploading file C:\Documents and Settings\All Users\Application Data\Network Associates\Common Framework\Unpack\pkg0000000_0000.spkg to ePO Server...
20080610231431 I #3996 InetMgr Connecting to Real Server: <servername> on port: 80
20080610231431 I #3996 InetMgr Connected to ePO Server: <servername>
20080610231431 I #3996 InetMgr Uploading SPIPE HTTP header
20080610231431 I #3996 InetMgr Uploading data in bytes: 8192
20080610231431 I #3996 InetMgr Uploading data in bytes: 8192
20080610231431 I #3996 InetMgr Uploading data in bytes: 8138
20080610231431 I #3996 InetMgr Reading acknowledgement from ePO Server
20080610231432 I #3996 InetMgr Received response [] from ePO Server
20080610231432 I #3996 InetMgr Failed due to timedout when send/receive to/from Server
20080610231432 I #3996 InetMgr HTTP Session closed
20080610231432 I #3996 InetMgr ------------------------------------------------------------
20080610231432 I #3996 InetMgr Failed connecting to site = ePO_<servername>,
20080610231432 I #3996 InetMgr No failover site available.
20080610231432 e #3996 InetMgr Failed to connect to server <servername> Check the agent log for more details.
20080610231432 e #3996 Agent Agent failed to communicate with ePO Server
20080610231432 i #3996 Agent Agent communication session closed
20080610231432 I #3996 Agent Agent communication failed, result=-2400

I marked the (from my point of view) important line and I think that this leads to the result that the agents are uploading their events again and again, but never deleting them. this leads to the point that my database just explodes... :eek:

KB46469 does not help me, since I have these problems only on clients behind our firewall. Smiley Sad

does someone know if the http-packets that should be received from the client can be destroyed by some sort of firewall-included security-system? the rules within the firewall are set to allow all communication.
or does someone else have a similar problem and can give me a hint what I may try?

the only workaround I have at the moment ist disabling the events within the ePO-server, but since I would like to see some nice reports, this is not really an option to me.

thanks in advance!
1 Reply

RE: CMA is uploading events, but not deleting them


I would like to give a short status-update...

Problem is a traffice-/data-optimizer called Riverbed Steelhead. :mad:
Somehow it destroys the answers from the ePO-server.
Enabled a pass through rule for communication from the outside to our central ePO-server and now it works. In my opinion only a workaround... Smiley Sad

Does anyone else use Riverbed Steelhead and has the similar problem?