cancel
Showing results for 
Search instead for 
Did you mean: 
frecar
Level 9
Report Inappropriate Content
Message 1 of 9

Virusscan for Mac 9.1 (Security for Mac 1.1) support for Lion 10.7.2 Security for Mac 9.1 (1.1) support for Lion 10.7.2

Jump to solution

Hello!

I've been testing some Lion machines with the latest version of Security 1.1 build 1309 with agent 4.6.0.1694.

The installation of the agent works fine. The computer reports back to the EPO. But it wont deploy Virusscan 9.1 for Mac.

I have downloade the Virusscan 9.1 zip file and checked in the package and extention in the repository. I also have checked in the hotfix.

I'll get the following error, one of many but I think this error is what it is all about.

2012-01-24 11:50:32 [126]  [Management]  None of the policies exists for the software Id VSCANMAC9100

Best regards

Freddie

1 Solution

Accepted Solutions
frecar
Level 9
Report Inappropriate Content
Message 8 of 9

Re: Virusscan for Mac 9.1 (Security for Mac 1.1) support for Lion 10.7.2 Security for Mac 9.1 (1.1) support for Lion 10.7.2

Jump to solution

Hi,

I have now solved this issue. The extention is the problem.

This is what I did to solve it:

1. I have checked in McAfee VirusScan for Mac v9.1 package and extentions.

2. Assignd a pollicy and so on...

3. Deployment of Virusscan won't work

4. I check in the extention for McAfee Endpoint Protection for Mac 1.1, the one with the firewall included. New version of the extention is 9.1.0.3031, the old one were 9.1.0.3030. If you just look att the version number of the policy it must be a really small change.

5. Now everything work!

Best regards

Freddie

Message was edited by: frecar on 1/25/12 8:23:06 AM CST
8 Replies

Re: Virusscan for Mac 9.1 (Security for Mac 1.1) support for Lion 10.7.2 Security for Mac 9.1 (1.1) support for Lion 10.7.2

Jump to solution

Hi Freddie,

Is the deployment task actually kicking off to install Vscan?

Are these clean machines with no AV on them or pervious agent as there's a specific set of instructions on how to upgrade the clients that already have a previous av or agent version.

Also, What version of ePO are you running?

What hotfix?

edit: Also, what build of Lion are you running?

Can you attach the log file at all?

Thanks

Message was edited by: jmcleish on 25/01/12 03:55:09 CST
frecar
Level 9
Report Inappropriate Content
Message 3 of 9

Re: Virusscan for Mac 9.1 (Security for Mac 1.1) support for Lion 10.7.2 Security for Mac 9.1 (1.1) support for Lion 10.7.2

Jump to solution

Hi,

Thanks for your fast answer!

Is the deployment task actually kicking off to install Vscan? I have read the logs correct the answer is no.

Any erlier AV products? No and it is a completly new install of OS X 10.7.2

Also, What version of ePO are you running? 4.6.0 build 1029

What hotfix? No hotfix

What build of Lion are you running? 10.7.2 /11C74)

Thanks again!

/Freddie

Message was edited by: frecar on 1/25/12 4:13:41 AM CST

Re: Virusscan for Mac 9.1 (Security for Mac 1.1) support for Lion 10.7.2 Security for Mac 9.1 (1.1) support for Lion 10.7.2

Jump to solution

Can you modify the deployment task slightly (i.e. set to run immediately, and stop the task running for more than 6 hours for example) and do an agent wakeup call.

What is it showing in the client log when you do a wakeup- can you post it please?

Sorry- you mentioned you'd checked in a hotfix- what hotfix are you referring to?

frecar
Level 9
Report Inappropriate Content
Message 5 of 9

Re: Virusscan for Mac 9.1 (Security for Mac 1.1) support for Lion 10.7.2 Security for Mac 9.1 (1.1) support for Lion 10.7.2

Jump to solution

Hotfix 688476 for Virusscan 9.1.

2012-01-25 12:48:02 [92]  [Management]  Enforcing policies

2012-01-25 12:48:02 [92]  [Management]  Legacy Policies exists for the software Id EPOAGENT3700MACX

2012-01-25 12:48:02 [92]    [Plugin]  Going to Enforce Policy

2012-01-25 12:48:02 [92]     [events] Creating event interface object

2012-01-25 12:48:02 [92]    [Plugin]  Going to Check Software Exists

2012-01-25 12:48:02 [92]     [events] deleting event interface object

2012-01-25 12:48:02 [92]     [Agent]  Enforcing agent policies

2012-01-25 12:48:02 [92]  [Management]  Enforcing management subsystem policies

2012-01-25 12:48:02 [92]  [Management]  Properties collection is marked for Maximum

2012-01-25 12:48:02 [92]    [updsubs] Enforcing updater subsystem policies

2012-01-25 12:48:02 [92] [Management] Retrieved current event policies successfully

2012-01-25 12:48:02 [92] [Management] Event policies unchanged

2012-01-25 12:48:02 [92] [Management] Finished event policy update

2012-01-25 12:48:02 [92]     [Agent]  Next Policy Enforcement will be in : 300 seconds

2012-01-25 12:52:15 [92]     [Agent]  Forward immediate events request received

2012-01-25 12:52:44 [92]    [Pckproc] after wait timeInterval=2147483647

2012-01-25 12:52:44 [92]    [Pckproc] start processPackage timeInterval=2147483647

2012-01-25 12:52:44 [92]     [Agent]  Received agent ping from ePO server

2012-01-25 12:52:44 [92]    [Pckproc] end processPackage timeInterval=2147483647

2012-01-25 12:52:44 [92]    [Pckproc] before wait timeInterval=2147483647

2012-01-25 12:52:45 [92]     [Agent]  Verifying agent GUID

2012-01-25 12:52:45 [92]     [Agent]  Agent will connect to Server in : 0 seconds

2012-01-25 12:52:45 [92]        [Asc] m_lastASCITime = 1327492365

2012-01-25 12:52:45 [92]     [Agent]  Agent started performing ASCI

2012-01-25 12:52:45 [92]  [Management]  Collecting properties

2012-01-25 12:52:45 [92]    [Plugin]  Going to Collect Properties

2012-01-25 12:52:45 [92]     [events] Creating event interface object

2012-01-25 12:52:45 [92]    [Plugin]  Going to Check Software Exists

2012-01-25 12:52:45 [92]  [Cryptshim] Successfully freed key data

2012-01-25 12:52:45 [92]    [agProps] Setting the properties as :/Library/McAfee/cma : 4.6.0.1694 : 4.6.0.1694 : 5 : 60 : {90EBE19B-C945-E111-854A-000000000000} : 8081 : 1 :

2012-01-25 12:52:45 [92]     [events] deleting event interface object

2012-01-25 12:52:45 [92]     [Agent]  Forward all events request received

2012-01-25 12:52:45 [92]    [Pckproc] after wait timeInterval=2147483647

2012-01-25 12:52:45 [92]    [Pckproc] start processPackage timeInterval=2147483647

2012-01-25 12:52:45 [92]  [Management]  Requested for the Full Props by the Agent

2012-01-25 12:52:45 [92]     [Agent]  Verifying agent GUID

2012-01-25 12:52:45 [92]     [Agent]  Agent will connect to Server in : 1216 seconds

2012-01-25 12:52:45 [92]    [SpiPkgr] Using sequence number 102

2012-01-25 12:52:45 [92]     [Agent]  Agent server communication session started

2012-01-25 12:52:45 [92]     [Agent]  Package type is propssend package

2012-01-25 12:52:45 [92]     [Agent]  Agent is connecting to ePO server

2012-01-25 12:53:02 [92]  [Management]  Enforcing policies

2012-01-25 12:53:02 [92]  [Management]  Legacy Policies exists for the software Id EPOAGENT3700MACX

2012-01-25 12:53:02 [92]    [Plugin]  Going to Enforce Policy

2012-01-25 12:53:02 [92]     [events] Creating event interface object

2012-01-25 12:53:02 [92]    [Plugin]  Going to Check Software Exists

2012-01-25 12:53:02 [92]     [events] deleting event interface object

2012-01-25 12:53:02 [92]     [Agent]  Enforcing agent policies

2012-01-25 12:53:02 [92]  [Management]  Enforcing management subsystem policies

2012-01-25 12:53:02 [92]  [Management]  Properties collection is marked for Maximum

2012-01-25 12:53:02 [92]    [updsubs] Enforcing updater subsystem policies

2012-01-25 12:53:02 [92] [Management] Retrieved current event policies successfully

2012-01-25 12:53:02 [92] [Management] Event policies unchanged

2012-01-25 12:53:02 [92] [Management] Finished event policy update

2012-01-25 12:53:02 [92]     [Agent]  Next Policy Enforcement will be in : 300 seconds

2012-01-25 12:54:00 [92]     [imsite] Found site name=McAfeeFtp

2012-01-25 12:54:00 [92]     [imsite] Found site name=ePO_hidden-EPO01

2012-01-25 12:54:00 [92]     [imsite] Found site name=ePO_hidden-AH01

2012-01-25 12:54:00 [92]    [persite] Starting sorting of repositories using ping time

2012-01-25 12:54:00 [92]     [naInet] HTTP Session initialized

2012-01-25 12:54:00 [92]     [naInet] HTTP Session initialized

2012-01-25 12:54:00 [92]     [imsite] Pinging SPIPE site = ePO_hidden-AH01

2012-01-25 12:54:00 [92]     [imsite] IP address = 112.62.95.58

2012-01-25 12:54:00 [92]     [imsite] Pinging SPIPE site = ePO_hidden-EPO01

2012-01-25 12:54:00 [92]       [ping] ICMP:Smiley Tongueing - Pinging 112.62.95.58 with a timeout of 30 seconds

2012-01-25 12:54:00 [92]     [imsite] IP address = 192.168.0.173

2012-01-25 12:54:00 [92]       [ping] ICMP:Smiley Tongueing - Pinging 192.168.0.173 with a timeout of 30 seconds

2012-01-25 12:54:00 [92]       [ping] ICMP:Smiley Tongueing - Avg ping time is 0

2012-01-25 12:54:00 [92]     [imsite] Delay = 0 (in millisecs)

2012-01-25 12:55:30 [92]     [imsite] Ping using IP address failed.

2012-01-25 12:55:30 [92]     [imsite] Site name = hidden-EPO01.hidden.LOCAL

2012-01-25 12:55:30 [92]       [ping] ICMP:Smiley Tongueing - Pinging hidden-EPO01.hidden.LOCAL with a timeout of 30 seconds

2012-01-25 12:55:35 [92]     [imsite] Ping using site name failed.

2012-01-25 12:55:35 [92]     [imsite] Computer name = hidden-EPO01

2012-01-25 12:55:35 [92]       [ping] ICMP:Smiley Tongueing - Pinging hidden-EPO01 with a timeout of 30 seconds

2012-01-25 12:55:40 [92]     [imsite] Ping using computer name failed.

2012-01-25 12:55:40 [92]     [imsite] Connecting to site = ePO_hidden-EPO01

2012-01-25 12:56:56 [92]     [naInet] Unable to connect to 192.168.0.173 on port 443.

2012-01-25 12:57:06 [92]     [naInet] Unable to connect to hidden-EPO01.hidden.LOCAL on port 443.

2012-01-25 12:57:15 [92]     [Agent]  Forward immediate events request received

2012-01-25 12:57:16 [92]     [naInet] Unable to connect to hidden-EPO01 on port 443.

2012-01-25 12:57:16 [92]     [imsite] Failed to connect to site ePO_hidden-EPO01

2012-01-25 12:57:16 [92]     [imsite] Delay = 65535 (in millisecs)

2012-01-25 12:57:16 [92]    [persite] Sorting of repositories finished successfully. Total number of repositories sorted:3

2012-01-25 12:57:16 [92]     [naInet] HTTP Session closed

2012-01-25 12:57:16 [92]     [naInet] HTTP Session closed

2012-01-25 12:57:16 [92]    [imutils] Trying with site: 192.168.0.173:80

2012-01-25 12:57:16 [92]     [naInet] HTTP Session initialized

2012-01-25 12:57:16 [92]     [imsite]            Upload from: /Library/McAfee/cma/scratch/Unpack/pkgWedJan251152452012_1436132830.spkg

2012-01-25 12:57:16 [92]     [imsite]            Upload response target: /Library/McAfee/cma/scratch/Unpack/pkgWedJan251152452012_1515765177.spkg

2012-01-25 12:58:02 [92]  [Management]  Enforcing policies

2012-01-25 12:58:02 [92]  [Management]  Legacy Policies exists for the software Id EPOAGENT3700MACX

2012-01-25 12:58:02 [92]    [Plugin]  Going to Enforce Policy

2012-01-25 12:58:02 [92]     [events] Creating event interface object

2012-01-25 12:58:02 [92]    [Plugin]  Going to Check Software Exists

2012-01-25 12:58:02 [92]     [events] deleting event interface object

2012-01-25 12:58:02 [92]     [Agent]  Enforcing agent policies

2012-01-25 12:58:02 [92]  [Management]  Enforcing management subsystem policies

2012-01-25 12:58:02 [92]  [Management]  Properties collection is marked for Maximum

2012-01-25 12:58:02 [92]    [updsubs] Enforcing updater subsystem policies

2012-01-25 12:58:02 [92] [Management] Retrieved current event policies successfully

2012-01-25 12:58:02 [92] [Management] Event policies unchanged

2012-01-25 12:58:02 [92] [Management] Finished event policy update

2012-01-25 12:58:02 [92]     [Agent]  Next Policy Enforcement will be in : 3

Re: Virusscan for Mac 9.1 (Security for Mac 1.1) support for Lion 10.7.2 Security for Mac 9.1 (1.1) support for Lion 10.7.2

Jump to solution

Doesn't look like its picking up the task.

I would expect to see entries like this:

2012-01-25 10:36:22 [27260]     [Agent]  New server policy was successfully merged

2012-01-25 10:36:22 [27260]     [Agent]  Enforcing newly downloaded policies

....

2012-01-25 10:36:31 [27260]  [Scheduler]  Restarting task scheduler...

2012-01-25 10:36:34 [27260]  [Scheduler]  Task [Install Mac AV 9.1] loaded successfully

2012-01-25 10:36:44 [27260]  [Scheduler]  Invoking task [Install Mac AV 9.1]...

Create a new task just for that machine and then do a wakeup and see what happens.

I don't use 4.6 yet myself, but did notice this KB article.

maybe check the file and see:

Macs running Security for Mac 1.1 become unmanageable

                                          

Corporate KnowledgeBase ID:  KB72321
Last Modified:  July 01, 2011

 

Environment

McAfee Security for Mac 1.1
Mac OS X

Problem

When McAfee Security for Mac 1.1 is managed via McAfee ePolicy Orchestrator 4.6, the Mac may become unmanageable.

NOTE: The Mac will become unmanageable only in scenarios where it cannot contact a Domain controller. If the Mac can resolve the Domain name, it will be able to connect to the ePO server and manageability is retained.

Cause

The following fields are missing from the SiteList.xml file:

  • SecurePort
  • ServerName
  • ServerIP
  • Version
  • LocalVersion

McAfee Agent cannot interpret SiteList.xml without these fields and so the Mac becomes unmanageable.

Solution

McAfee is aware of this issue.

This issue is being evaluated for consideration in a future release or patched version of the product. If this issue significantly impacts your business operations, contact McAfee Technical Support and quote this article number to help us assess the need for a Product Enhancement Request (PER).

This article will be updated as newer information becomes available.

HTH

frecar
Level 9
Report Inappropriate Content
Message 7 of 9

Re: Virusscan for Mac 9.1 (Security for Mac 1.1) support for Lion 10.7.2 Security for Mac 9.1 (1.1) support for Lion 10.7.2

Jump to solution

Edit: I undertood you wrong. Now I understand.

Thanks for all the help!!!

I will have to talk to McAfee about this. This is a really big deal for us.

Best regards

/Freddie

Message was edited by: frecar on 1/25/12 7:34:18 AM CST
frecar
Level 9
Report Inappropriate Content
Message 8 of 9

Re: Virusscan for Mac 9.1 (Security for Mac 1.1) support for Lion 10.7.2 Security for Mac 9.1 (1.1) support for Lion 10.7.2

Jump to solution

Hi,

I have now solved this issue. The extention is the problem.

This is what I did to solve it:

1. I have checked in McAfee VirusScan for Mac v9.1 package and extentions.

2. Assignd a pollicy and so on...

3. Deployment of Virusscan won't work

4. I check in the extention for McAfee Endpoint Protection for Mac 1.1, the one with the firewall included. New version of the extention is 9.1.0.3031, the old one were 9.1.0.3030. If you just look att the version number of the policy it must be a really small change.

5. Now everything work!

Best regards

Freddie

Message was edited by: frecar on 1/25/12 8:23:06 AM CST

Re: Virusscan for Mac 9.1 (Security for Mac 1.1) support for Lion 10.7.2 Security for Mac 9.1 (1.1) support for Lion 10.7.2

Jump to solution

Glad you got it sorted.