Loss of EPo to Agent Communication

[cg-windstream]

I have had a couple of client-servers with agents which had been communication with EPo and updating fine.  Then on unrelated dates, (months apart, different subnets and all that) .

• We are using 1 main EPo 4.6 Server and client Agents 4.6 (No secondary's or supers)
• The client is able to telnet to the EPo Server via ports 443 & 80. 
• The Epo Server is able to telnet to the client via 8081. 
• (Same config as all the currently updating systems)
• I've tried the ping and wakeup agents buttons on the console with no change (of course).

I "fixed" one of them by reinstalling the agent but apparetnly that also had the effect of removing all the old info in the EPo database.

Before I do this to the 2nd client-server, I figured I'd ck with you more experienced admins.

THX

CG

[JoeBidgood]

First thing is to check the client end - start with the agent log, and see what errors are recorded when it tries to communicate. Feel free to attach a log here if you like and we can take a look.

HTH -

Joe

[cg-windstream]

Thanks Joe,

Here's the log.  I don't see anything useful but then I don't really know what I'm looking for.  Last Communication                                                                    7/9/13 9:31:41 PM

4/4/2013    3:23:11 PM    Would be blocked by Access Protection rule  (rule is currently not enforced)     PAETECAUTH\mcafeesrv    C:\WINDOWS\Explorer.EXE    C:\WINDOWS\Temp\{CE15D1B6-19B6-4D4D-8F43-CF5D2C3356FF}\nailite.dll    Common Standard Protection:Prevent common programs from running files from the Temp folder    Action blocked : Execute

5/2/2013    6:18:15 PM    Would be blocked by Access Protection rule  (rule is currently not enforced)     PAETECAUTH\e0148985    C:\Program Files\Internet Explorer\iexplore.exe    C:\Documents and Settings\e0148985\Local Settings\Temporary Internet Files\Content.IE5\GPM7CPM3\JavaSetup7u21[1].exe    Common Standard Protection:Prevent common programs from running files from the Temp folder    Action blocked : Execute

5/9/2013    2:46:46 PM    Would be blocked by Access Protection rule  (rule is currently not enforced)     PAETECAUTH\e0148985    C:\Program Files\Internet Explorer\iexplore.exe    C:\Documents and Settings\e0148985\Local Settings\Temporary Internet Files\Content.IE5\96VBYAVX\Firefox%20Setup%2020.0.1[1].exe    Common Standard Protection:Prevent common programs from running files from the Temp folder    Action blocked : Execute

5/9/2013    2:47:25 PM    Would be blocked by Access Protection rule  (rule is currently not enforced)     PAETECAUTH\e0148985    C:\WINDOWS\Explorer.EXE    C:\Documents and Settings\e0148985\Local Settings\Temp\1\7zS3.tmp\setup.exe    Common Standard Protection:Prevent common programs from running files from the Temp folder    Action blocked : Execute

5/9/2013    2:47:42 PM    Would be blocked by Access Protection rule  (rule is currently not enforced)     PAETECAUTH\e0148985    C:\WINDOWS\Explorer.EXE    C:\Documents and Settings\e0148985\Local Settings\Temp\1\7zS3.tmp\setup.exe    Common Standard Protection:Prevent common programs from running files from the Temp folder    Action blocked : Execute

5/9/2013    2:47:52 PM    Would be blocked by Access Protection rule  (rule is currently not enforced)     PAETECAUTH\e0148985    C:\WINDOWS\Explorer.EXE    C:\Documents and Settings\e0148985\Local Settings\Temp\1\7zS3.tmp\setup.exe    Common Standard Protection:Prevent common programs from running files from the Temp folder    Action blocked : Execute

5/9/2013    2:48:38 PM    Would be blocked by Access Protection rule  (rule is currently not enforced)     PAETECAUTH\e0148985    C:\WINDOWS\Explorer.EXE    C:\Documents and Settings\e0148985\Local Settings\Temp\1\7zS3.tmp\setup.exe    Common Standard Protection:Prevent common programs from running files from the Temp folder    Action blocked : Execute

7/18/2013    9:32:17 PM    Would be blocked by Access Protection rule  (rule is currently not enforced)     PAETECAUTH\ndk40594    C:\Program Files\Internet Explorer\IEXPLORE.EXE    C:\Documents and Settings\nkauble\Local Settings\Temporary Internet Files\Content.IE5\GPM7CPM3\JavaSetup7u25[1].exe    Common Standard Protection:Prevent common programs from running files from the Temp folder    Action blocked : Execute

7/18/2013    9:33:15 PM    Would be blocked by Access Protection rule  (rule is currently not enforced)     PAETECAUTH\ndk40594    C:\WINDOWS\Explorer.EXE    C:\Documents and Settings\nkauble\Local Settings\Temp\3\MSI4.tmp    Common Standard Protection:Prevent common programs from running files from the Temp folder    Action blocked : Execute

1/8/2014    9:24:36 PM    Would be blocked by Access Protection rule  (rule is currently not enforced)     PAETECAUTH\e0148985    C:\WINDOWS\Explorer.EXE    C:\Documents and Settings\e0148985\Local Settings\Temp\2\jre-7u45-windows-i586-iftw.exe    Common Standard Protection:Prevent common programs from running files from the Temp folder    Action blocked : Execute

4/10/2014    8:34:56 PM    Would be blocked by Access Protection rule  (rule is currently not enforced)     PAETECAUTH\mcafeesrv    C:\WINDOWS\Explorer.EXE    C:\Documents and Settings\McAfeeSRV\Local Settings\Temp\2\GLB1.tmp    Common Standard Protection:Prevent common programs from running files from the Temp folder    Action blocked : Execute

4/10/2014    8:55:34 PM    Would be blocked by Access Protection rule  (rule is currently not enforced)     PAETECAUTH\mcafeesrv    C:\WINDOWS\Explorer.EXE    C:\Documents and Settings\McAfeeSRV\Local Settings\Temp\2\GLB1.tmp    Common Standard Protection:Prevent common programs from running files from the Temp folder    Action blocked : Execute

4/10/2014    9:10:24 PM    Would be blocked by Access Protection rule  (rule is currently not enforced)     PAETECAUTH\mcafeesrv    C:\WINDOWS\Explorer.EXE    C:\Documents and Settings\McAfeeSRV\Local Settings\Temp\2\GLB5.tmp    Common Standard Protection:Prevent common programs from running files from the Temp folder    Action blocked : Execute

4/10/2014    9:10:39 PM    Would be blocked by Access Protection rule  (rule is currently not enforced)     PAETECAUTH\mcafeesrv    C:\WINDOWS\Explorer.EXE    C:\Documents and Settings\McAfeeSRV\Local Settings\Temp\2\GLB9.tmp    Common Standard Protection:Prevent common programs from running files from the Temp folder    Action blocked : Execute

[JoeBidgood]

That looks more like the access protection log - the one we're after is the agent log, which will be called agent_<name of the machine>.log and will live in %programdata%\Mcafee\DB by default. If you can zip and attach the whole file here, that would be great - please don't cut and paste the contents as it will probably be quite large

Thanks -

Joe

[cg-windstream]

Details, details.  Thanks for the details.  (:>)

[JoeBidgood]

Hm, there's almost nothing in there at all Certainly not what I would expect to see from an active agent.

In the same folder there should be an agent_<machinename>_backup.log - is there anything useful-looking in there, or does it just contain the same string of messages as the agent log? If there is, can you attach it?

Thanks -

Joe

[cg-windstream]

.Probably because the last successful communication & update was in July 8, 2013!

The Agent_VPNACS1-ROC_backup.log has exactly the same listings except for the beginning & end dates.  The McScript_backup.log looks more interesting.  I don't know that any of it is useful but here it is.try

I may just try reinstalling the Agent.  What bad thing might occur with that approach?

[JoeBidgood · Accepted solution]

I would definitely reinstall the agent in this case... there's nothing really in the logs that can help us, so I'd just uninstall and reinstall on this one machine.

HTH -

Joe