cancel
Showing results for 
Search instead for 
Did you mean: 
jpettersson
Level 9

McAfee Agent problems - updating DAT/Engine

Jump to solution

In our environment we have alot of computers and some of them have trouble to update the DAT/engine. Some of the agents are repoting that the client has never updated the VSE, some says it can't identify - leaving the DAT version empty and the last ones, the stranges once are the one that says DAT version N/A.

Do someone recognize this problems? I have confirmed it has nothing to do with ports being closed etc.

Im using ePO 4.0, Agent 4.0.0.1494, VSE 8.5.0.781.

Thanks!

0 Kudos
1 Solution

Accepted Solutions
jpettersson
Level 9

Re: McAfee Agent problems - updating DAT/Engine

Jump to solution

It didn't work for me, thanks thou!

I did find a working solution for the agents that reported back a blank DAT/Engine which was:

[HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePolicyOrchestrator\Application Plugins\Viruscan8600] "Plugin

Flag"=dword:00000008(8)

Chaning that value to "0" instead.

I have no solution yet for the ones that repots N/A as the DAT/Engine.

0 Kudos
12 Replies
jpettersson
Level 9

Re: McAfee Agent problems - updating DAT/Engine

Jump to solution

EDIT: It's ePO 4.5 Build 851.

0 Kudos
tonyb99
Level 13

Re: McAfee Agent problems - updating DAT/Engine

Jump to solution

That sounds like a lot of problems.

I assume that the agents were originally installed under an EPo 4.0 install and then its been upgraded to 4.5?

Were there any issues with the upgrade like the certificate that might explain the loss of function?

Have you tried sending out a new agent force installed over the other and then checking what happens.

Do you have the two tasks to maintain duplicate GUIDs enabled in epo 4.5, I dont  think the agent version you are using supports GUID autoregeneration but the next one up does.

What patch level of VSE 8.5 are you using

Are you getting error in the parser logs on epo?

If you set an update to run can you show us the log section from a client at this point when it fails

Also programs such as deepfreeze, registry protectors or lack of space on clients could all cause this too

0 Kudos
jpettersson
Level 9

Re: McAfee Agent problems - updating DAT/Engine

Jump to solution

Thanks for reply,

It has always been a 4.5(what I know of), I just wrote wrong first. Its around 50 machines, based in different countries, which has theese problems, maybe round 0.5% of the computers.

Yes I have forced new installation of the Agent, sometimes it works sometimes not.

The VSE 8.5 is patch 8. I get no errors at all in the parser log file. I'll try to get the logs from a client up here.

Could you please explain that "Two tasks to maintain duplicate GUIDs enables"?

Some of the clients that have N/A as DAT get's updated when I performce force wakeup with force policy etc. But some of them don't.

Thanks once more

0 Kudos
apoling
Level 14

Re: McAfee Agent problems - updating DAT/Engine

Jump to solution

Hi,

please allow me to butt in. tonyb99 suggests that your management system would be able to make one common problem (source of agent not getting tasks, policies from ePo server) go away: the one that is related to duplicate agent GUIDs on clients. However, this requires a certain client agent version. (As far as I know it is McAfee Agent 4.0 Patch 3 and 4.5 is capable of recognizing agentGUDI regeneration requests from ePO server.)

(Taking your exact problems aside, this move has to be done regardless of any problems you have.

As far your exact problem is concerned, it would be good to diagnose what your issue is exactly rootored in. Could you please take a look at into McScript.log on one problem client? McScript.log is where your own computer have one, look for the same path on the remote client, too.

updating problems do not necessarily come from duplicate GUID.

Attila

0 Kudos
jpettersson
Level 9

Re: McAfee Agent problems - updating DAT/Engine

Jump to solution

Here's one

McAfee Agent Activity Log; debug logs: FrameSvc fom a Agent that report in a blank(empty) DAT/engine:

den 20 juni 2011 09:28:10

Info

Agent

Agent uploading 14 events to ePO Server

den 20 juni 2011 09:28:10

Info

Agent

Agent communication session started

den 20 juni 2011 09:28:10

Info

Agent

Agent is sending FULL PROPS package ePO server

den 20 juni 2011 09:28:10

Info

Agent

Agent is connecting to ePO server

den 20 juni 2011 09:28:11

Info

Agent

Package uploaded to ePO Server successfully

den 20 juni 2011 09:28:11

Info

Agent

Agent communication session closed

den 20 juni 2011 09:28:11

Info

Agent

Agent received POLICY package from ePO server

den 20 juni 2011 09:28:11

Info

Agent

New server policy was successfully merged

den 20 juni 2011 09:28:11

Info

Agent

Enforcing newly downloaded policies

den 20 juni 2011 09:28:11

Info

Agent

Agent Started Enforcing policies

den 20 juni 2011 09:28:11

Info

Management

Compiling policies

den 20 juni 2011 09:28:11

Info

Agent

Agent communication session started

den 20 juni 2011 09:28:11

Info

Agent

Agent is sending EVENT package to ePO server

den 20 juni 2011 09:28:11

Info

Agent

Agent is connecting to ePO server

den 20 juni 2011 09:28:11

Info

Agent

No package received from ePO Server

den 20 juni 2011 09:28:11

Info

Agent

Agent communication session closed

den 20 juni 2011 09:28:12

Info

Management

Enforcing Policies for EPOAGENT3000META

den 20 juni 2011 09:28:12

Info

Management

Enforcing Policies for EPOAGENT3000

den 20 juni 2011 09:28:12

Info

Management

Enforcing Policies for McAfee Agent

den 20 juni 2011 09:28:12

Info

Agent

Agent finished Enforcing policies

den 20 juni 2011 09:28:12

Info

Agent

Next policy enforcement in 60 minutes

den 20 juni 2011 09:31:30

Info

Updater

Backing up file(s) Engine DAT

den 20 juni 2011 09:31:33

Info

Updater

Pre-notifying for DAT update.

den 20 juni 2011 09:31:33

Info

Updater

Copying DAT.

den 20 juni 2011 09:31:34

Info

Updater

Update succeeded to version 6382.0000.

den 20 juni 2011 09:31:34

Info

Updater

Post-notifying for DAT update.

den 20 juni 2011 09:31:35

Info

Updater

Verifying VSE850Det.McS.

den 20 juni 2011 09:31:37

Info

Updater

Update Finished

0 Kudos
jpettersson
Level 9

Re: McAfee Agent problems - updating DAT/Engine

Jump to solution

And heres the same log but fom a Agent that has DAT/Engine = N/A:

den 20 juni 2011 09:25:50

Info

Updater

Downloading PkgCatalog.z.

den 20 juni 2011 09:25:50

Info

Updater

Verifying PkgCatalog.z.

den 20 juni 2011 09:25:50

Info

Updater

Extracting PkgCatalog.z.

den 20 juni 2011 09:25:50

Info

Updater

Loading update configuration from: PkgCatalog.xml

den 20 juni 2011 09:25:51

Info

Updater

Verifying V2engdet.mcs.

den 20 juni 2011 09:25:51

Info

Updater

Product(s) running the latest Engine.

den 20 juni 2011 09:25:51

Info

Updater

Downloading PkgCatalog.z.

den 20 juni 2011 09:25:51

Info

Updater

Verifying PkgCatalog.z.

den 20 juni 2011 09:25:51

Info

Updater

Extracting PkgCatalog.z.

den 20 juni 2011 09:25:51

Info

Updater

Loading update configuration from: PkgCatalog.xml

den 20 juni 2011 09:25:52

Info

Updater

Verifying V2datdet.mcs.

den 20 juni 2011 09:25:52

Info

Updater

Downloading PkgCatalog.z.

den 20 juni 2011 09:25:52

Info

Updater

Verifying PkgCatalog.z.

den 20 juni 2011 09:25:52

Info

Updater

Extracting PkgCatalog.z.

den 20 juni 2011 09:25:52

Info

Updater

Loading update configuration from: PkgCatalog.xml

den 20 juni 2011 09:25:53

Info

Updater

Starting DAT update.

den 20 juni 2011 09:25:53

Info

Updater

Downloading DAT.

den 20 juni 2011 09:25:53

Info

Updater

Downloading gdeltaavv.ini.

den 20 juni 2011 09:25:53

Info

Updater

Downloading 63796380avv.gem.

den 20 juni 2011 09:25:53

Info

Updater

Downloading 63806381avv.gem.

den 20 juni 2011 09:25:54

Info

Updater

Downloading 63816382avv.gem.

den 20 juni 2011 09:26:18

Info

Agent

Agent is looking for events to upload

den 20 juni 2011 09:26:18

Info

Agent

Agent uploading 1 events to ePO Server

den 20 juni 2011 09:26:18

Info

Agent

Agent communication session started

den 20 juni 2011 09:26:18

Info

Agent

Agent is sending EVENT package to ePO server

den 20 juni 2011 09:26:18

Info

Agent

Agent is connecting to ePO server

den 20 juni 2011 09:26:19

Info

Agent

No package received from ePO Server

den 20 juni 2011 09:26:19

Info

Agent

Agent communication session closed

den 20 juni 2011 09:31:18

Info

Agent

Agent is looking for events to upload

den 20 juni 2011 09:36:18

Info

Agent

Agent is looking for events to upload

den 20 juni 2011 09:41:18

Info

Agent

Agent is looking for events to upload

den 20 juni 2011 09:46:18

Info

Agent

Agent is looking for events to upload

den 20 juni 2011 09:51:18

Info

Agent

Agent is looking for events to upload

den 20 juni 2011 09:56:18

Info

Agent

Agent is looking for events to upload

den 20 juni 2011 10:01:18

Info

Agent

Agent is looking for events to upload

den 20 juni 2011 10:06:18

Info

Agent

Agent is looking for events to upload

den 20 juni 2011 10:11:18

Info

Agent

Agent is looking for events to upload

den 20 juni 2011 10:16:18

Info

Agent

Agent is looking for events to upload

den 20 juni 2011 10:21:18

Info

Agent

Agent is looking for events to upload

den 20 juni 2011 10:21:19

Info

Agent

Agent Started Enforcing policies

den 20 juni 2011 10:21:19

Info

Management

Enforcing Policies for VIRUSCAN8600

den 20 juni 2011 10:21:20

Info

Management

Enforcing Policies for EPOAGENT3000META

den 20 juni 2011 10:21:20

Info

Management

Enforcing Policies for EPOAGENT3000

den 20 juni 2011 10:21:20

Info

Management

Enforcing Policies for McAfee Agent

den 20 juni 2011 10:21:20

Info

Agent

Agent finished Enforcing policies

den 20 juni 2011 10:21:20

Info

Agent

Next policy enforcement in 60 minutes

den 20 juni 2011 10:26:18

Info

Agent

Agent is looking for events to upload

den 20 juni 2011 10:31:18

Info

Agent

Agent is looking for events to upload

den 20 juni 2011 10:36:18

Info

Agent

Agent is looking for events to upload

den 20 juni 2011 10:41:18

Info

Agent

Agent is looking for events to upload

den 20 juni 2011 10:46:18

Info

Agent

Agent is looking for events to upload

den 20 juni 2011 10:51:18

Info

Agent

Agent is looking for events to upload

den 20 juni 2011 10:56:18

Info

Agent

Agent is looking for events to upload

den 20 juni 2011 11:01:18

Info

Agent

Agent is looking for events to upload

den 20 juni 2011 11:06:18

Info

Agent

Agent is looking for events to upload

den 20 juni 2011 11:11:18

Info

Agent

Agent is looking for events to upload

den 20 juni 2011 11:16:18

Info

Agent

Agent is looking for events to upload

den 20 juni 2011 11:21:18

Info

Agent

Agent is looking for events to upload

den 20 juni 2011 11:21:20

Info

Agent

Agent Started Enforcing policies

den 20 juni 2011 11:21:20

Info

Management

Enforcing Policies for VIRUSCAN8600

den 20 juni 2011 11:21:20

Info

Management

Enforcing Policies for EPOAGENT3000META

den 20 juni 2011 11:21:20

Info

Management

Enforcing Policies for EPOAGENT3000

den 20 juni 2011 11:21:20

Info

Management

Enforcing Policies for McAfee Agent

0 Kudos
apoling
Level 14

Re: McAfee Agent problems - updating DAT/Engine

Jump to solution

Hi,

Please attach Agent log from the client you want to diagnose. The log excerpt you provided here is lacking important sections.

for example in the second attachment it is not confirmed whether ePO server accepted the packet or rejected the agent. This does not show from this high level log.

Nevertheless:

I recommend you change something in McAfee Agent policy, for example the ASCI frequency and initiate a contact with ePO server on the client. If the ASCI value then changes, then we can exclude rejection by ePO server of that client. Then we can go further.

However if the client is rejected, then we should go in a different direction (install new agent, and put the two server task in effect)

Attila

0 Kudos
jpettersson
Level 9

Re: McAfee Agent problems - updating DAT/Engine

Jump to solution

The main issue I want resolve is the ones that doesn't report any DAT at all. The other ones can be resolved by pushing out new agents etc.

If someone have experiences with clients not reporting back any DAT's I woud greatly appreciate it!

Thanks!

0 Kudos
McAfee Employee

Re: McAfee Agent problems - updating DAT/Engine

Jump to solution

Have a look at KB 60515 - this may help.Sometimes the dat and engine version can't be retrieved from the engine as it's busy.

HTH -

Joe

0 Kudos