cancel
Showing results for 
Search instead for 
Did you mean: 

Loss of EPo to Agent Communication

Jump to solution

I have had a couple of client-servers with agents which had been communication with EPo and updating fine.  Then on unrelated dates, (months apart, different subnets and all that) .

  • We are using 1 main EPo 4.6 Server and client Agents 4.6 (No secondary's or supers)
  • The client is able to telnet to the EPo Server via ports 443 & 80. 
  • The Epo Server is able to telnet to the client via 8081. 
  • (Same config as all the currently updating systems)
  • I've tried the ping and wakeup agents buttons on the console with no change (of course).

I "fixed" one of them by reinstalling the agent but apparetnly that also had the effect of removing all the old info in the EPo database.

Before I do this to the 2nd client-server, I figured I'd ck with you more experienced admins.

THX

CG

1 Solution

Accepted Solutions
McAfee Employee JoeBidgood
McAfee Employee
Report Inappropriate Content
Message 8 of 8

Re: Loss of EPo to Agent Communication

Jump to solution

I would definitely reinstall the agent in this case... there's nothing really in the logs that can help us, so I'd just uninstall and reinstall on this one machine.

HTH -

Joe

7 Replies
Highlighted
McAfee Employee JoeBidgood
McAfee Employee
Report Inappropriate Content
Message 2 of 8

Re: Loss of EPo to Agent Communication

Jump to solution

First thing is to check the client end - start with the agent log, and see what errors are recorded when it tries to communicate. Feel free to attach a log here if you like and we can take a look.

HTH -

Joe

Re: Loss of EPo to Agent Communication

Jump to solution

Thanks Joe,

Here's the log.  I don't see anything useful but then I don't really know what I'm looking for.  Last Communication                                                                    7/9/13 9:31:41 PM

4/4/2013    3:23:11 PM    Would be blocked by Access Protection rule  (rule is currently not enforced)     PAETECAUTH\mcafeesrv    C:\WINDOWS\Explorer.EXE    C:\WINDOWS\Temp\{CE15D1B6-19B6-4D4D-8F43-CF5D2C3356FF}\nailite.dll    Common Standard Protection:Prevent common programs from running files from the Temp folder    Action blocked : Execute

5/2/2013    6:18:15 PM    Would be blocked by Access Protection rule  (rule is currently not enforced)     PAETECAUTH\e0148985    C:\Program Files\Internet Explorer\iexplore.exe    C:\Documents and Settings\e0148985\Local Settings\Temporary Internet Files\Content.IE5\GPM7CPM3\JavaSetup7u21[1].exe    Common Standard Protection:Prevent common programs from running files from the Temp folder    Action blocked : Execute

5/9/2013    2:46:46 PM    Would be blocked by Access Protection rule  (rule is currently not enforced)     PAETECAUTH\e0148985    C:\Program Files\Internet Explorer\iexplore.exe    C:\Documents and Settings\e0148985\Local Settings\Temporary Internet Files\Content.IE5\96VBYAVX\Firefox%20Setup%2020.0.1[1].exe    Common Standard Protection:Prevent common programs from running files from the Temp folder    Action blocked : Execute

5/9/2013    2:47:25 PM    Would be blocked by Access Protection rule  (rule is currently not enforced)     PAETECAUTH\e0148985    C:\WINDOWS\Explorer.EXE    C:\Documents and Settings\e0148985\Local Settings\Temp\1\7zS3.tmp\setup.exe    Common Standard Protection:Prevent common programs from running files from the Temp folder    Action blocked : Execute

5/9/2013    2:47:42 PM    Would be blocked by Access Protection rule  (rule is currently not enforced)     PAETECAUTH\e0148985    C:\WINDOWS\Explorer.EXE    C:\Documents and Settings\e0148985\Local Settings\Temp\1\7zS3.tmp\setup.exe    Common Standard Protection:Prevent common programs from running files from the Temp folder    Action blocked : Execute

5/9/2013    2:47:52 PM    Would be blocked by Access Protection rule  (rule is currently not enforced)     PAETECAUTH\e0148985    C:\WINDOWS\Explorer.EXE    C:\Documents and Settings\e0148985\Local Settings\Temp\1\7zS3.tmp\setup.exe    Common Standard Protection:Prevent common programs from running files from the Temp folder    Action blocked : Execute

5/9/2013    2:48:38 PM    Would be blocked by Access Protection rule  (rule is currently not enforced)     PAETECAUTH\e0148985    C:\WINDOWS\Explorer.EXE    C:\Documents and Settings\e0148985\Local Settings\Temp\1\7zS3.tmp\setup.exe    Common Standard Protection:Prevent common programs from running files from the Temp folder    Action blocked : Execute

7/18/2013    9:32:17 PM    Would be blocked by Access Protection rule  (rule is currently not enforced)     PAETECAUTH\ndk40594    C:\Program Files\Internet Explorer\IEXPLORE.EXE    C:\Documents and Settings\nkauble\Local Settings\Temporary Internet Files\Content.IE5\GPM7CPM3\JavaSetup7u25[1].exe    Common Standard Protection:Prevent common programs from running files from the Temp folder    Action blocked : Execute

7/18/2013    9:33:15 PM    Would be blocked by Access Protection rule  (rule is currently not enforced)     PAETECAUTH\ndk40594    C:\WINDOWS\Explorer.EXE    C:\Documents and Settings\nkauble\Local Settings\Temp\3\MSI4.tmp    Common Standard Protection:Prevent common programs from running files from the Temp folder    Action blocked : Execute

1/8/2014    9:24:36 PM    Would be blocked by Access Protection rule  (rule is currently not enforced)     PAETECAUTH\e0148985    C:\WINDOWS\Explorer.EXE    C:\Documents and Settings\e0148985\Local Settings\Temp\2\jre-7u45-windows-i586-iftw.exe    Common Standard Protection:Prevent common programs from running files from the Temp folder    Action blocked : Execute

4/10/2014    8:34:56 PM    Would be blocked by Access Protection rule  (rule is currently not enforced)     PAETECAUTH\mcafeesrv    C:\WINDOWS\Explorer.EXE    C:\Documents and Settings\McAfeeSRV\Local Settings\Temp\2\GLB1.tmp    Common Standard Protection:Prevent common programs from running files from the Temp folder    Action blocked : Execute

4/10/2014    8:55:34 PM    Would be blocked by Access Protection rule  (rule is currently not enforced)     PAETECAUTH\mcafeesrv    C:\WINDOWS\Explorer.EXE    C:\Documents and Settings\McAfeeSRV\Local Settings\Temp\2\GLB1.tmp    Common Standard Protection:Prevent common programs from running files from the Temp folder    Action blocked : Execute

4/10/2014    9:10:24 PM    Would be blocked by Access Protection rule  (rule is currently not enforced)     PAETECAUTH\mcafeesrv    C:\WINDOWS\Explorer.EXE    C:\Documents and Settings\McAfeeSRV\Local Settings\Temp\2\GLB5.tmp    Common Standard Protection:Prevent common programs from running files from the Temp folder    Action blocked : Execute

4/10/2014    9:10:39 PM    Would be blocked by Access Protection rule  (rule is currently not enforced)     PAETECAUTH\mcafeesrv    C:\WINDOWS\Explorer.EXE    C:\Documents and Settings\McAfeeSRV\Local Settings\Temp\2\GLB9.tmp    Common Standard Protection:Prevent common programs from running files from the Temp folder    Action blocked : Execute

McAfee Employee JoeBidgood
McAfee Employee
Report Inappropriate Content
Message 4 of 8

Re: Loss of EPo to Agent Communication

Jump to solution

That looks more like the access protection log - the one we're after is the agent log, which will be called agent_<name of the machine>.log and will live in %programdata%\Mcafee\DB by default. If you can zip and attach the whole file here, that would be great - please don't cut and paste the contents as it will probably be quite large

Thanks -

Joe

Re: Loss of EPo to Agent Communication

Jump to solution

Details, details.  Thanks for the details.  (:>)

McAfee Employee JoeBidgood
McAfee Employee
Report Inappropriate Content
Message 6 of 8

Re: Loss of EPo to Agent Communication

Jump to solution

Hm, there's almost nothing in there at all Certainly not what I would expect to see from an active agent.

In the same folder there should be an agent_<machinename>_backup.log - is there anything useful-looking in there, or does it just contain the same string of messages as the agent log? If there is, can you attach it?

Thanks -

Joe

Re: Loss of EPo to Agent Communication

Jump to solution

.Probably because the last successful communication & update was in July 8, 2013!

The Agent_VPNACS1-ROC_backup.log has exactly the same listings except for the beginning & end dates.  The McScript_backup.log looks more interesting.  I don't know that any of it is useful but here it is.try

I may just try reinstalling the Agent.  What bad thing might occur with that approach?

McAfee Employee JoeBidgood
McAfee Employee
Report Inappropriate Content
Message 8 of 8

Re: Loss of EPo to Agent Communication

Jump to solution

I would definitely reinstall the agent in this case... there's nothing really in the logs that can help us, so I'd just uninstall and reinstall on this one machine.

HTH -

Joe

More McAfee Tools to Help You

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community