cancel
Showing results for 
Search instead for 
Did you mean: 

Verifying Signature Files

I am working on developing a script for installing/registering McAfee Agents.

One of my requirements is that the script can capture a portion of the log that confirms the latest signature files have been applied to the VM. 

I require this for both windows and mcafee agents.

Currently I am looking in Windows: c:\programdata\mcafee\agent\logs

and Linux:  /var/McAfee/agent/logs

Does McAfee log this information somewhere?

 

EDIT 1

For Windows in the masvc_AGENTNAME.log I have found:

...msgbus.Info .verify code signature returns <0>, GetLastError <0>.

But, I am not sure if this line verifies that the signatures are the latest.

Tags (1)
7 Replies
McAfee Employee cdinet
McAfee Employee
Report Inappropriate Content
Message 2 of 8

Re: Verifying Signature Files

Is this for ens or VSE?  

For Windows with ENS, you would see something like this in the masvc log:

Updater.Info: Script Event : EID:0, Sev:4, ProductId:AMCORDAT2000, Locale:0000, Type:AMCore, State:8, Error:0, NewVersion:3512.0

I don't have a VSE system to look at those type entries, but it would be similar - look for VSCANDAT1000 maybe.  

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

Re: Verifying Signature Files

These are agent's of an EPO server

(i hope that answers the question)

McAfee Employee cdinet
McAfee Employee
Report Inappropriate Content
Message 4 of 8

Re: Verifying Signature Files

I understand that, but the content/dat versions are only applicable for whatever antivirus you have installed.  The agent itself, without those installed, does not have any use for any content updates.  So you need to know whether you are looking for dats (VSE and VSE for Linux) or amcore content (ENS and ENS for Linux).

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

Re: Verifying Signature Files

VSE is what I am using
McAfee Employee cdinet
McAfee Employee
Report Inappropriate Content
Message 6 of 8

Re: Verifying Signature Files

You can get that info easier through EPO queries and reports, just as a suggestion.

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

Re: Verifying Signature Files

I have been given an assignment where I am to have the agent's installation and registration script (which is run on the agent), to report back all the necessary information: successful and correct epo server connectivity, as well as proper signatures.
Can I do EPO queries from the agent?
Highlighted
McAfee Employee cdinet
McAfee Employee
Report Inappropriate Content
Message 8 of 8

Re: Verifying Signature Files

Well, on Windows you can check the registry information probably easier for VSE as well as agent information.  I am not sure exactly what you are looking for regarding the agent itself, though.  

for 64 bit systems (Windows)

[HKEY_LOCAL_MACHINE\Software\Wow6432node\Network Associates\ePolicy Orchestrator\Agent]
Has eposerverlist key that lists the epo server and agent handlers

[HKEY_LOCAL_MACHINE\Software\Wow6432node\Network Associates\ePolicy Orchestrator\Application Plugins\EPOAGENT3000]
lists agent version under version key

Here is an example of an older VSE reg key that lists dat version and patch level:

[HKEY_LOCAL_MACHINE\Software\Wow6432node\Network Associates\ePolicy Orchestrator\Application Plugins\VIRUSCAN8800]
"Product Name"="McAfee VirusScan Enterprise Workstation"
"CLSID"="{9BE8D8A1-2DB5-4A29-A95F-50C8B27820DA}"
"HotFixVersions"="8"
"Installs CMA"=dword:00000001(1)
"Install Path"="C:\Program Files (x86)\McAfee\VirusScan Enterprise\"
"Language"="0000"
"McTrayAboutBoxDisplay"=dword:00000000(0)
"Plugin Flag"=dword:00000000(0)
"Plugin Path"="C:\Program Files (x86)\McAfee\VirusScan Enterprise\VsPlugin.dll"
"Software ID"="VIRUSCAN8800"
"Uninstall Command"="msiexec /x {CE15D1B6-19B6-4D4D-8F43-CF5D2C3356FF} REMOVE=ALL REBOOT=R /q"
"Version"="8.8.0.1599"
"ExtraDatInstallDate"="20180213132959"
"LastExtraDATVersion"="2017.0628.1226.21"
"EngineInstallDate"="20180213133059"
"EngineVersion"="5900.7806"
"DatDate"="20181004"
"DatInstallDate"="20181004012217"
"DATVersion"="9035.0000"

For LInux systems, you can view the config files here for the agent and point products installed. 
/etc/ma.d/

However, I don't think that will give you the dat version.  You can look in the mcscript log for something like this entry:

UpdateType " DAT" UpdateError " 0" New Version " 9051.0000" Date Time " 20181019"

 

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

More McAfee Tools to Help You

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community