cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted

Unable to view agent logs, not connected to ePO

On any agent that is over version 5.6, anytime I go to Sing System Troubleshooting to try and view a log, after 30 or so seconds, I get the following message:
The selected system cannot use this feature as the system is not connected to ePO

This happens on agent version 5.6.0.878 (in the middle of getting rid of that one) and 5.6.1.157.  I have not tried every single system, but I have yet to come across a successful view.  I have tried waking up the agent, seeing the last communication change to now, and I'm able to ping the system.  I can view logs of agents on version 5.5.1.388 the old fashioned way.

Is there a setting I'm missing somewhere?

10 Replies
McAfee Employee cdinet
McAfee Employee
Report Inappropriate Content
Message 2 of 11

Re: Unable to view agent logs, not connected to ePO

Please refer to KB91283 - remote log access has been disabled to resolve a vulnerability.  The new procedure for viewing agent logs is explained in that KB. 

On a side note, see KB91418 regarding the 5.6.0.878 version of the agent.  I would highly recommend upgrading it to the 5.6.1 agent.

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

Re: Unable to view agent logs, not connected to ePO

I totally understand the new way of viewing agent logs, that's why I said "...anytime I go to Sing System Troubleshooting..." (so I misspelled Single, sorry), and I gave the message that pops up there instead of showing the logs like it's supposed to.  I also mentioned that I am trying to get rid of agent version 5.6.0; it is not an easy task as my systems only have about 50% reachability time due to this being a school with many systems being in labs that regularly go to sleep, and McAfee doesn't have any WOL abilities apparently.

No offense, but I get the distinct impression you barely even skimmed my issue.

McAfee Employee cdinet
McAfee Employee
Report Inappropriate Content
Message 4 of 11

Re: Unable to view agent logs, not connected to ePO

So sorry, I read it quickly before a meeting I had to get to.  No offense taken - my fault.

The one line you posted is concerning is that it says the system is not connected to epo.  When you get that message, is that when the system is off or asleep, or do you also get it when the system should be responding?  When they are awake, does the system communicate ok, or does it fail? 

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

Re: Unable to view agent logs, not connected to ePO

Yes, it is awake.  Before creating this post I did the following:

Send a Wake-Up command from ePO

Waited less than 30 seconds to see that the last communication field changed to the current time

Pinged the device with a command prompt

Tried going to Single System Troubleshooting

Page comes, after about 5 seconds I see the message:

Collection of logs is initiated

After 40~60 seconds I see the message:

The selected system cannot use this feature as the system is not connected to ePO

I go back to System View and wake the agent successfully, with the Last Communication updating.

I try again, and get the same results.  This happens with both wired and wireless clients.  Is there an option somewhere I need to turn, some agent setting?  I do have it UNCHECKED where it says "Accept connections only from the ePO server".screenshot.47.jpg

Something else maybe?

McAfee Employee cdinet
McAfee Employee
Report Inappropriate Content
Message 6 of 11

Re: Unable to view agent logs, not connected to ePO

What do you have enabled or disabled on the logging tab of the policy?  Does the masvc or macmnsvc log on the client show any entries related to an access attempt?

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

Re: Unable to view agent logs, not connected to ePO

It was originally set for Enable application logging and Enable remote Logging.  I enabled Enable remote access to log, woke a test client, made sure the last communicated changed, tried to get the log and same thing.

I'm not too sure what to look for in the logs. I see the following:
2019-05-23 17:02:14.911 masvc(26988.27400) ahclient.Info: Agent communication session started
2019-05-23 17:02:14.914 masvc(26988.27400) ahclient.Info: Agent is connecting to ePO server
2019-05-23 17:02:14.916 masvc(26988.27400) ahclient.Info: Initiating spipe connection to site https://xxx.xxx.xxx.xxx:443/spipe/pkg?AgentGuid={03d7205c-7cdc-11e9-153e-485b392be908}&Source=Agent_....
2019-05-23 17:02:14.919 masvc(26988.27400) ahclient.Info: connection initiated to site https://xxx.xxx.xxx.xxx:443/spipe/pkg?AgentGuid={03d7205c-7cdc-11e9-153e-485b392be908}&Source=Agent_....
2019-05-23 17:02:14.934 masvc(26988.11460) RemoteLogManager.Info: Minimal logs request
2019-05-23 17:02:15.071 masvc(26988.11460) RemoteLogManager.Info: Successfully sent the DC meesage for block <1> with corrrelation ID <22>
2019-05-23 17:02:15.084 masvc(26988.11460) RemoteLogManager.Info: All logs request
2019-05-23 17:02:17.115 masvc(26988.27400) svcmgr.Info: Get the subscribers list for input topic name <dxl.subscribe.*>
2019-05-23 17:02:18.742 masvc(26988.27400) DataChannelHandler.Info: Received epo.datachannel.msgbus.request.type.msgupload from client : EPOAGENT3000
2019-05-23 17:02:19.718 masvc(26988.27400) ahclient.Info: Network library rc = <1008>, Agent handler reports response code <202>.
2019-05-23 17:02:19.719 masvc(26988.27400) ahclient.Info: Agent handler doesn't have anything to send. response code 202.</dxl.subscribe.*>

In the http addresses, it does have the correct IP address of our ePO server, I just redacted it.

McAfee Employee cdinet
McAfee Employee
Report Inappropriate Content
Message 8 of 11

Re: Unable to view agent logs, not connected to ePO

So you know the agent is communicating to epo ok - do you still get the same error?  The macmnsvc log on the client should show something at same time frame that you try to access remote agent logs.  Let me test mine to see what the log entries would show.

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

Re: Unable to view agent logs, not connected to ePO

Error message persists.

When trying to initiate single system troubleshooting (again, IP address redacted), macmnsvc log shows:

http_server.Info: ma_http_connection_t(0000000000BBF6E0) accepting tcp connection from xxx.xxx.xxx.xxx:64545

Followed by this 18 seconds later:

http_server.Info: ma_http_connection_t(0000000000BBF6E0) ma_http_connection_send_stock_response, response(200 OK)

The masvc log shows what I shared before.  The thing that stands out to me, not that I know anything about this, is the message that says "Agent handler doesn't have anything to send."

Just so you can get a bigger picture, this issue came to my attention because many of my clients have an AMCore Content Version (which is equivalent to the DAT files for virus scan during the days of yore, right?) that isn't the most current.  The only thing I've been able to find was that some older agents had this problem, but this is happening on clients with agent version 5.6.1.157.  When I try to manually run a Client Task to update AMCore Content Package, nothing ever happens, not even on the progress page; it doesn't even show that it fails, I just see 1/3 of a grey bar that never progresses.

So when that was happening, I wanted to look at the agent logs which ended up with me making this thread.

McAfee Employee cdinet
McAfee Employee
Report Inappropriate Content
Message 10 of 11

Re: Unable to view agent logs, not connected to ePO

Can you get to the c$ drive of the system to pull logs in the meantime?  I would suggest opening a ticket with McAfee, as I haven't see that particular error before for the system not being connected to epo when it clearly is.

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator