cancel
Showing results for 
Search instead for 
Did you mean: 

Loss of EPo to Agent Communication

Jump to solution

I have had a couple of client-servers with agents which had been communication with EPo and updating fine.  Then on unrelated dates, (months apart, different subnets and all that) .

  • We are using 1 main EPo 4.6 Server and client Agents 4.6 (No secondary's or supers)
  • The client is able to telnet to the EPo Server via ports 443 & 80. 
  • The Epo Server is able to telnet to the client via 8081. 
  • (Same config as all the currently updating systems)
  • I've tried the ping and wakeup agents buttons on the console with no change (of course).

I "fixed" one of them by reinstalling the agent but apparetnly that also had the effect of removing all the old info in the EPo database.

Before I do this to the 2nd client-server, I figured I'd ck with you more experienced admins.

THX

CG

1 Solution

Accepted Solutions
JoeBidgood McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 8 of 8

Re: Loss of EPo to Agent Communication

Jump to solution

I would definitely reinstall the agent in this case... there's nothing really in the logs that can help us, so I'd just uninstall and reinstall on this one machine.

HTH -

Joe

View solution in original post

7 Replies
JoeBidgood McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 8

Re: Loss of EPo to Agent Communication

Jump to solution

First thing is to check the client end - start with the agent log, and see what errors are recorded when it tries to communicate. Feel free to attach a log here if you like and we can take a look.

HTH -

Joe

Re: Loss of EPo to Agent Communication

Jump to solution

Thanks Joe,

Here's the log.  I don't see anything useful but then I don't really know what I'm looking for.  Last Communication                                                                    7/9/13 9:31:41 PM

4/4/2013    3:23:11 PM    Would be blocked by Access Protection rule  (rule is currently not enforced)     PAETECAUTH\mcafeesrv    C:\WINDOWS\Explorer.EXE    C:\WINDOWS\Temp\{CE15D1B6-19B6-4D4D-8F43-CF5D2C3356FF}\nailite.dll    Common Standard Protection:Prevent common programs from running files from the Temp folder    Action blocked : Execute

5/2/2013    6:18:15 PM    Would be blocked by Access Protection rule  (rule is currently not enforced)     PAETECAUTH\e0148985    C:\Program Files\Internet Explorer\iexplore.exe    C:\Documents and Settings\e0148985\Local Settings\Temporary Internet Files\Content.IE5\GPM7CPM3\JavaSetup7u21[1].exe    Common Standard Protection:Prevent common programs from running files from the Temp folder    Action blocked : Execute

5/9/2013    2:46:46 PM    Would be blocked by Access Protection rule  (rule is currently not enforced)     PAETECAUTH\e0148985    C:\Program Files\Internet Explorer\iexplore.exe    C:\Documents and Settings\e0148985\Local Settings\Temporary Internet Files\Content.IE5\96VBYAVX\Firefox%20Setup%2020.0.1[1].exe    Common Standard Protection:Prevent common programs from running files from the Temp folder    Action blocked : Execute

5/9/2013    2:47:25 PM    Would be blocked by Access Protection rule  (rule is currently not enforced)     PAETECAUTH\e0148985    C:\WINDOWS\Explorer.EXE    C:\Documents and Settings\e0148985\Local Settings\Temp\1\7zS3.tmp\setup.exe    Common Standard Protection:Prevent common programs from running files from the Temp folder    Action blocked : Execute

5/9/2013    2:47:42 PM    Would be blocked by Access Protection rule  (rule is currently not enforced)     PAETECAUTH\e0148985    C:\WINDOWS\Explorer.EXE    C:\Documents and Settings\e0148985\Local Settings\Temp\1\7zS3.tmp\setup.exe    Common Standard Protection:Prevent common programs from running files from the Temp folder    Action blocked : Execute

5/9/2013    2:47:52 PM    Would be blocked by Access Protection rule  (rule is currently not enforced)     PAETECAUTH\e0148985    C:\WINDOWS\Explorer.EXE    C:\Documents and Settings\e0148985\Local Settings\Temp\1\7zS3.tmp\setup.exe    Common Standard Protection:Prevent common programs from running files from the Temp folder    Action blocked : Execute

5/9/2013    2:48:38 PM    Would be blocked by Access Protection rule  (rule is currently not enforced)     PAETECAUTH\e0148985    C:\WINDOWS\Explorer.EXE    C:\Documents and Settings\e0148985\Local Settings\Temp\1\7zS3.tmp\setup.exe    Common Standard Protection:Prevent common programs from running files from the Temp folder    Action blocked : Execute

7/18/2013    9:32:17 PM    Would be blocked by Access Protection rule  (rule is currently not enforced)     PAETECAUTH\ndk40594    C:\Program Files\Internet Explorer\IEXPLORE.EXE    C:\Documents and Settings\nkauble\Local Settings\Temporary Internet Files\Content.IE5\GPM7CPM3\JavaSetup7u25[1].exe    Common Standard Protection:Prevent common programs from running files from the Temp folder    Action blocked : Execute

7/18/2013    9:33:15 PM    Would be blocked by Access Protection rule  (rule is currently not enforced)     PAETECAUTH\ndk40594    C:\WINDOWS\Explorer.EXE    C:\Documents and Settings\nkauble\Local Settings\Temp\3\MSI4.tmp    Common Standard Protection:Prevent common programs from running files from the Temp folder    Action blocked : Execute

1/8/2014    9:24:36 PM    Would be blocked by Access Protection rule  (rule is currently not enforced)     PAETECAUTH\e0148985    C:\WINDOWS\Explorer.EXE    C:\Documents and Settings\e0148985\Local Settings\Temp\2\jre-7u45-windows-i586-iftw.exe    Common Standard Protection:Prevent common programs from running files from the Temp folder    Action blocked : Execute

4/10/2014    8:34:56 PM    Would be blocked by Access Protection rule  (rule is currently not enforced)     PAETECAUTH\mcafeesrv    C:\WINDOWS\Explorer.EXE    C:\Documents and Settings\McAfeeSRV\Local Settings\Temp\2\GLB1.tmp    Common Standard Protection:Prevent common programs from running files from the Temp folder    Action blocked : Execute

4/10/2014    8:55:34 PM    Would be blocked by Access Protection rule  (rule is currently not enforced)     PAETECAUTH\mcafeesrv    C:\WINDOWS\Explorer.EXE    C:\Documents and Settings\McAfeeSRV\Local Settings\Temp\2\GLB1.tmp    Common Standard Protection:Prevent common programs from running files from the Temp folder    Action blocked : Execute

4/10/2014    9:10:24 PM    Would be blocked by Access Protection rule  (rule is currently not enforced)     PAETECAUTH\mcafeesrv    C:\WINDOWS\Explorer.EXE    C:\Documents and Settings\McAfeeSRV\Local Settings\Temp\2\GLB5.tmp    Common Standard Protection:Prevent common programs from running files from the Temp folder    Action blocked : Execute

4/10/2014    9:10:39 PM    Would be blocked by Access Protection rule  (rule is currently not enforced)     PAETECAUTH\mcafeesrv    C:\WINDOWS\Explorer.EXE    C:\Documents and Settings\McAfeeSRV\Local Settings\Temp\2\GLB9.tmp    Common Standard Protection:Prevent common programs from running files from the Temp folder    Action blocked : Execute

JoeBidgood McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 4 of 8

Re: Loss of EPo to Agent Communication

Jump to solution

That looks more like the access protection log - the one we're after is the agent log, which will be called agent_<name of the machine>.log and will live in %programdata%\Mcafee\DB by default. If you can zip and attach the whole file here, that would be great - please don't cut and paste the contents as it will probably be quite large

Thanks -

Joe

Re: Loss of EPo to Agent Communication

Jump to solution

Details, details.  Thanks for the details.  (:>)

JoeBidgood McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 6 of 8

Re: Loss of EPo to Agent Communication

Jump to solution

Hm, there's almost nothing in there at all Certainly not what I would expect to see from an active agent.

In the same folder there should be an agent_<machinename>_backup.log - is there anything useful-looking in there, or does it just contain the same string of messages as the agent log? If there is, can you attach it?

Thanks -

Joe

Highlighted

Re: Loss of EPo to Agent Communication

Jump to solution

.Probably because the last successful communication & update was in July 8, 2013!

The Agent_VPNACS1-ROC_backup.log has exactly the same listings except for the beginning & end dates.  The McScript_backup.log looks more interesting.  I don't know that any of it is useful but here it is.try

I may just try reinstalling the Agent.  What bad thing might occur with that approach?

JoeBidgood McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 8 of 8

Re: Loss of EPo to Agent Communication

Jump to solution

I would definitely reinstall the agent in this case... there's nothing really in the logs that can help us, so I'd just uninstall and reinstall on this one machine.

HTH -

Joe

View solution in original post

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community