New to the community so i apologize if this has been discussed previously. Unsure of where to find a search bar.
We recently have noticed a number of our windows server 2003 hosts go unresponsive intermittently. At first, we saw that there were a slew of messages in the access protection log blocking a EMC Navisphere Agent service from terminating McAfee processes. I have discussed this with both sides and it turns out that the service may be checking the ports for properties and in turn, McAfee will treat it as an attempted attack to terminate services. I have since added this exclusion and have even disabled "prevent McAfee services from being stopped" as the rule may be inherent to child policies. However, our woes continue.
After further investigation, we strongly feel that a corrupt agent install may be to source of this issue although they have been running for months without any previously reported issues. The agent status monitor didn't appear to be acting normally, as it was reporting "100 events to upload" over and over again and/or unable to contacting the epo server.
We decided to uninstall all products last night and it seemed as though the agent uninstall would simply hang with "15 minutes" left on the progress status. it would sit that way for about 30 minutes until we decided to cancel out and disable the service if possible at that point. Fast forward to this morning, we noticed that there are tons of XML files in
c:\documents and settings\all users\application data\mcafee\common framework\agentevents\ on the affected machines. the number of files and how far they date back is unknown. just to give you an idea, a dir from the cmd prompt wouldn't even return the list of files and a windows explorer delete from the directory above would run for about 45 minutes to delete all of the contents. all the while, the c:\ itself was never full.
Has anyone else experienced anything like this? Is there a way to track corrupted agent installs prior to getting in this position? Can a successful agent install eventually enter a corrupted state on its own? Thanks.
FRMINST_system.log will tell you currept installation, location is windows\temp\mcafeelogs if deployed.
In your case I believe agents to server communication was not going on and you tried to remove agents and it didnt worked.As you have tried to remove agents as well and process was halted, So now you can use frminst\forceuninstall switch to remove halted uninstallation process and then redeploy them.
Also go for agents logs and verify the error message and copy here.
THe FRMINST_SYSTEM.log was last written in 10/12/12 so this doesn't give us much info as the original install appears to be OK. However, at some point the \agentevents\ directory became extremely backlogged with XML that were not uploaded properly to the ePO server. I believe this was the reason for the uninstall to appear to be halted, when in fact, it was just taking a VEEEERY long time to clean up these files.
What causes this to happen?
Is this the directory that fills up?
If Yes, could you verify LogLevel size here for me
no, the directory is c:\documents and settings\all users\application data\mcafee\common framework\agentevents\
also, this is windows 2003 host. your first path above is invalid. if the correct path for 2003 is C:\Documents and Settings\All Users\Application Data\McAfee\Common Framework\Db, then no this is not filling up either.
OHH, I just typed the path for W2008, You are right, Now in your server2003 Registry, could you check Log level for this directory, from above location?
the value is 7.
Just got off of the phone with ePO support. It turns out that our ASCI interval was configured for 1440 minutes (once per day) and the events may have been piling up because of this. I have adjusted the value to 180 minutes for now and will try to reinstall the agent where needed.
Value is okay,with default Error Reporting.Lets see if it works, although now ASCI would take place more sooner.
Report if it doesnt work.
So far so good.
So it seems that the .XML files in the \AgentEvents\ directory may have been caused by the Access Protection rules blocking the NaviAgent.exe from accessing its services. Once i updated the exclusions, these events stopped occurring. However, the events had piled up to a point of no return where an ASCI of 1 day would be unlikely to recover. I have since reconfigured the ASCI to 3 hours (default 90 minutes i believe).
We went ahead and used the McAfee removal tool to uninstall all products and then reinstalled through the EPO server and have not seen this reoccur. Thanks.