cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted
Level 7
Report Inappropriate Content
Message 1 of 9

The process McTray.exe has initiated the restart of computer Reason Code: 0x0

Greetings!!

Anyone sees the captioned message in the System Log? In which case McTray.exe will initiate a server reboot?

Our server hung right after those events. We are finding the root cause of request to reboot by McTray.exe. Any suggestion would be greatly appreciated.

Abstraction:

#########################################################################################

System Log:

INFORMATION08/11/201412:00:00EventLogNone6013N/AOSSERVERThe system uptime is 7603302 seconds.
INFORMATION08/11/201421:21:45USER32None1074AdministratorOSSERVERThe process McTray.exe has initiated the restart of computer OSSERVER on behalf of user OSSERVER\Administrator for the following reason: No title for this reason could be found    Reason Code: 0x0    Shutdown Type: restart    Comment:    00 00 00 00
WARNING08/11/201421:21:46USER32None1073AdministratorOSSERVERThe attempt by user OSSERVER\Administrator to restart/shutdown computer OSSERVER failed 80 48 3E 77
INFORMATION08/11/201421:25:21Service Control ManagerNone7035SYSTEMOSSERVERThe SIMATIC NET Core Server PD service was successfully sent a stop control. None
INFORMATION08/11/201421:25:24Service Control ManagerNone7036N/AOSSERVERThe SIMATIC NET Core Server PD service entered the stopped state. None
ERROR08/11/201421:25:36DCOMNone10010N/AOSSERVERThe server {B6EACB30-42D5-11D0-9517-0020AFAA4B3C} did not register with DCOM within the required timeout. None
INFORMATION08/11/201421:25:52Service Control ManagerNone7036N/AOSSERVERThe EracentEPAService service entered the stopped state. None
INFORMATION08/11/201421:25:57Service Control ManagerNone7036N/AOSSERVERThe EracentEPMService service entered the stopped state. None
ERROR08/11/201421:26:06DCOMNone10010N/AOSSERVERThe server {FDEB47B4-DD9C-459E-9B9E-E40D1C06A69F} did not register with DCOM within the required timeout. None
ERROR08/11/201421:26:06DCOMNone10010N/AOSSERVERThe server {1D3F9B73-DDB3-485F-A646-65E87A14145E} did not register with DCOM within the required timeout. None
INFORMATION08/11/201421:26:18EventLogNone6006N/AOSSERVERThe Event log service was stopped.

#########################################################################################

Application Log:

INFORMATION08/11/201421:18:41McLogEventNone5000SYSTEMOSSERVERMcShield service started.    Engine version : 5600.1067    DAT version : 7616.0000        Number of signatures in EXTRA.DAT : None    Names of threats that EXTRA.DAT can detect : None None
INFORMATION08/11/201421:24:43RebootApplication 513N/AOSSERVERCWinCCProjectWrapper::OnDeactivateProjectEnd: Project is now deactivated None
WARNING08/11/201421:24:45RedundancyControlNone273N/AOSSERVERState changed to FAULT => server is isolated None
WARNING08/11/201421:24:46RedundancyControlNone273N/AOSSERVERReboot of computer disabled by SIMATIC WinCC. reason: No autostart and no autologin configured None
ERROR08/11/201421:24:46RedundancyControlNone257N/AOSSERVERCProxyIRedundancyControl::WinCCFireThread - Error  800706BF  causes failover None
INFORMATION08/11/201421:24:46RebootApplication 513N/AOSSERVERdisconnected from RedundancyControl None
INFORMATION08/11/201421:24:46RebootApplication 513N/AOSSERVERRedundancy send FAULT State None
ERROR08/11/201421:24:47RebootApplication 257N/AOSSERVERShow RebootDialog None
INFORMATION08/11/201421:25:45EracentEPAServiceNone0N/AOSSERVERNoneNone
INFORMATION08/11/201421:25:52EracentEPAServiceNone0N/AOSSERVERNoneNone
INFORMATION08/11/201421:25:52EracentEPMServiceNone0N/AOSSERVERNoneNone
INFORMATION08/11/201421:25:57EracentEPMServiceNone0N/AOSSERVERNoneNone
INFORMATION08/11/201421:25:57MSSQL$WINCCServer 17055N/AOSSERVER17147 :  SQL Server terminating because of system shutdown.

#########################################################################################

8 Replies

Re: The process McTray.exe has initiated the restart of computer <SERVERNAME> on behalf of user <SERVERNAME>\Administrator for the following reason: No title for this reason could be found Reason Code: 0x0 Shutdown Type: restart Comment:

Hi,

Disable automatic reboot from Agent --> General policy tab. and send wakeupcall and check.

Regards

Highlighted

Re: The process McTray.exe has initiated the restart of computer Reason Code: 0x0

Moved this to SIEM where I think it belongs and abbreviated the header so it fits the space provided - Moderator.

Highlighted
Level 10
Report Inappropriate Content
Message 4 of 9

Re: The process McTray.exe has initiated the restart of computer Reason Code: 0x0

Antivirus category, not SIEM.

Highlighted

Re: The process McTray.exe has initiated the restart of computer Reason Code: 0x0


Karim Sudki wrote:



Antivirus category, not SIEM.


Is that directed at me, the Moderator?   If so can you tell me exactly where this should go or what product you are discussing? 

Highlighted
Level 10
Report Inappropriate Content
Message 6 of 9

Re: The process McTray.exe has initiated the restart of computer Reason Code: 0x0

I am not a specialist, but you put that discussion into "SIEM" rather than "ePO" or "Endpoint Security".


McTray.exe  is part of McAfee Agent and the logs are mentionning Viruscan etc... Nothing really related to the SIEM.


Regards

Highlighted

Re: The process McTray.exe has initiated the restart of computer Reason Code: 0x0

OK it's now in ePO.  FYI you had posted it under the main Business section so I had no idea other than what was in your profile.

Highlighted
Level 10
Report Inappropriate Content
Message 8 of 9

Re: The process McTray.exe has initiated the restart of computer Reason Code: 0x0

Hi mtsang,

Did you enable full debug ont the agent, this link might help troubleshooting your issue which seems related to mcafee agent installation/update :

Regards

Highlighted
Level 7
Report Inappropriate Content
Message 9 of 9

Re: The process McTray.exe has initiated the restart of computer   Reason Code: 0x0

I did not have a chance to enable debug logging as the issue happened 1 month ago.

I have just searched McAfee KB and documents but didn't find any information about McTray.exe would initiate system reboot. So I wonder anyone heard of that.

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community