Showing results for 
Search instead for 
Did you mean: 

Rogue Sensor http 401 error

I'm having issues when deploying the Rogue sensors.

The sensors get installed on the clients but in the RSSensor_out.log file it is showing that I am getting a HTTP 401 error when connecting back to the server.

In the directory tree it is showing that RSD is installed and what subnet it is listening on, but in the rogue sensor section it is showing that all of my subnets are still uncovered and no sensors have been deployed.

I've tried uninstalling them through the deployment task and then re-installing them through the normal process (mark for deployment... deploy sensors)

Any thoughts?
Tags (1)
3 Replies

RE: Rogue Sensor http 401 error

I suppose u are on ePO 3.6.1, no clean install but upgrade to...Am i right?

Maybe u have to recreate certificates on the ePO server...

Post the exact error.

RE: Rogue Sensor http 401 error

Sending Data to server at https://***.***.***.***/snocap/engine
The server returned HTTP status: 401
NBSTAT IOException: Failed to read data from the server
10054:An existing connection was forcibly closed by the remote host.

I believe it was an upgrade. I just inherited the server, none of the clients were shown as deployed (green check mark) when I got it, but the previous SA said that he had deployed everything. I had to go manually reinstall the framepkg on each client to get them to check in. So it must have been an upgrade or something. I'm sure its a cert problem but I copied, what i thought were, the new certs onto the client machines.

RE: Rogue Sensor http 401 error

I reloaded the certs following one of the McAfee KB's and pushed everything back out. I'm still getting the same HTTP 401 error in the RSSensor_out.log file.

Any other suggestions?