cancel
Showing results for 
Search instead for 
Did you mean: 
tekexp
Level 7
Report Inappropriate Content
Message 1 of 4

EventParser doesnt process events from VSE 8.8

Jump to solution

Hello,

before 2 weeks i had upgraded ePO to the latest ver. 5.3.0 with latest HotFixes and VSE 8.8 with Patch 6, latest Mngm & Report Extensions. Now i see that there is no data on the Dashboard for VSE: Current Detections and the last data is from the week 23-29 Aug. Thats the time when i did the upgrades.

I checked and all events are stored in..."\\DB\Events\Debug\"  All of the content is about events from VSE only and obviously are not process by EventParser and not stored into the DB.

In EventParser log file i see that errors:

20150911191304E#05556EVNTPRSRsource\server.cpp(1097): Failed to find interface for <SAEEvent>, hr=0x80004002.
20150911191304E#05556EVNTPRSRsource\server.cpp(1173): Failed to process file D:\MA_ePO_SRV\DB\Events\5e872a2c-220c-4398-aaf2-66e06d93db85-20150911100759788132300002904.xml.
20150911191304E#03540EVNTPRSRsource\server.cpp(1097): Failed to find interface for <SAEEvent>, hr=0x80004002.
20150911191304E#03540EVNTPRSRsource\server.cpp(1173): Failed to process file D:\MA_ePO_SRV\DB\Events\5e872a2c-220c-4398-aaf2-66e06d93db85-20150911093800030122700002590.xml.
20150911191324I#05172EVNTPRSRSucceeded <UpdateEvents>, D:\MA_ePO_SRV\DB\Events\2554b7ad-47f7-48bd-8518-60785ea637ee-20150911100921892175300003EE0.txml.
20150911191403E#05172VseBll  DAL->ExecQuery failed. hr=80040e10
20150911191403E#05172EVNTPRSRsource\server.cpp(1110): COM Error 0x80004005, source=(null), desc=(null), msg=Unspecified error
20150911191403E#05172VseBll  DAL->ExecQuery failed. hr=80040e10
20150911191403E#05172EVNTPRSRsource\server.cpp(1110): COM Error 0x80004005, source=(null), desc=(null), msg=Unspecified error
20150911191403E#03540VseBll  DAL->ExecQuery failed. hr=80040e10
20150911191403E#03540EVNTPRSRsource\server.cpp(1110): COM Error 0x80004005, source=(null), desc=(null), msg=Unspecified error
20150911191403E#05172VseBll  DAL->ExecQuery failed. hr=80040e10
20150911191403E#05172EVNTPRSRsource\server.cpp(1110): COM Error 0x80004005, source=(null), desc=(null), msg=Unspecified error
20150911191403E#05172EVNTPRSRsource\server.cpp(1173): Failed to process file D:\MA_ePO_SRV\DB\Events\0c63d582-468c-434e-b99a-37a12fb3a90e-201509111012573198991000009BC.txml.
20150911191403E#03540VseBll  DAL->ExecQuery failed. hr=80040e10
20150911191403E#03540EVNTPRSRsource\server.cpp(1110): COM Error 0x80004005, source=(null), desc=(null), msg=Unspecified error
20150911191403E#03540VseBll  DAL->ExecQuery failed. hr=80040e10
20150911191403E#03540EVNTPRSRsource\server.cpp(1110): COM Error 0x80004005, source=(null), desc=(null), msg=Unspecified error
20150911191403E#03540EVNTPRSRsource\server.cpp(1173): Failed to process file D:\MA_ePO_SRV\DB\Events\0c63d582-468c-434e-b99a-37a12fb3a90e-201509111012569139183000009BC.txml.

When scroll down as i checked for each event in the Events folder there is that kind of errors in EventParser log file.

Untill now i restart ePO services a few times, reinstalled VSE report extensions, reboot the machine without luck to fix that.

What is your advice here?

Regards,

B

1 Solution

Accepted Solutions
Reliable Contributor Nielsb
Reliable Contributor
Report Inappropriate Content
Message 3 of 4

Re: EventParser doesnt process events from VSE 8.8

Jump to solution

This is related to the reporting extension:

Reference NumberRelated ArticleIssue Description
1090227KB85551Issue: VirusScan threat events do not parse to the ePO database with VirusScan Enterprise Reports Extension 1.2.0.263.
Workaround: Check in the Patch 5 Reporting Extension (1.2.0.250) until an updated extension becomes available.
Status: Intel Security is investigating this issue. See the related article for workaround steps.

McAfee KnowledgeBase - VirusScan Enterprise 8.8 Patch 6 Known Issues

3 Replies
Highlighted
Reliable Contributor exbrit
Reliable Contributor
Report Inappropriate Content
Message 2 of 4

Re: EventParser doesnt process events from VSE 8.8

Jump to solution

Moved to ePO for better support.

---

Moderator

Reliable Contributor Nielsb
Reliable Contributor
Report Inappropriate Content
Message 3 of 4

Re: EventParser doesnt process events from VSE 8.8

Jump to solution

This is related to the reporting extension:

Reference NumberRelated ArticleIssue Description
1090227KB85551Issue: VirusScan threat events do not parse to the ePO database with VirusScan Enterprise Reports Extension 1.2.0.263.
Workaround: Check in the Patch 5 Reporting Extension (1.2.0.250) until an updated extension becomes available.
Status: Intel Security is investigating this issue. See the related article for workaround steps.

McAfee KnowledgeBase - VirusScan Enterprise 8.8 Patch 6 Known Issues

tekexp
Level 7
Report Inappropriate Content
Message 4 of 4

Re: EventParser doesnt process events from VSE 8.8

Jump to solution

Tnx, just found the article in KB and the mentioned workaround is working.

MPower Badge Now Available
Customers attending MPower can earn a community badge. Check into the MPower forum and say hi to have the badge awarded to your community profile.