cancel
Showing results for 
Search instead for 
Did you mean: 
HerbSmith
Level 9

ePO 4.6 Patch 4 and Dat Reporting

Upgraded from ePO 4.6P3 to ePO 4.6P4 today.  Upgrade went smoothly.  Services were down for about 12 minutes.

However something happened with the Dat version that a lot of clients were reporting.  Before the grade I had about 80 machines that were talking regularly to ePO that did not have their DAT current.   After the upgrade the same dashboard monitor was report over 1100 out of spec.  During the day that has declined to around 450.  But still a terrible blow to my compliance numbers.   This is out of  population of about 20,000 which includes about 3700 labtops.  Most of the problem machines were showing a DAT from several weeks ago on Products Page in the DAT column by the VSE product.

All endpoints are running MA 4.6.0.2935.  VSE 8.8.849.  All laptops have hips 7.0 P9 and EEPC 6.2.

These are about 99% laptops.   About 2/3 of the problems machines had last connected via our VPN or via the Agent Handler in the DMZ.  The remote machines were way over represented in the problem population.

Displaying the client events for the problem machines I could see entries for update to todays DAT.  I check some agent logs and they showed the end point has updated it DAT last night to the current version.   It appears that sending a wake up call with force full policy and task update would fix many of them.   Without the force full policy and task the success rate was much lower.   Can't send wake up calls to those connecting via the agent handler in the DMZ.  (Nat'ed firewalls at both ends).   And many VPN users check in only every few days so who knows how long it will take to clear up.

What kind of issues could have caused this?

What other hidden damage may have been done to my data by the upgrade?

Thanks

0 Kudos
3 Replies
McAfee Employee

Re: ePO 4.6 Patch 4 and Dat Reporting

I'm really not sure what could have happened there. As far as I'm aware there's nothing in this upgrade that would cause this - it almost sounds as though some of the machines' properties were changed, which the upgrade doesn't do.

I'm really at a loss here, I'm afraid

What DAT version is being reported by the machines that are showing as non-compliant?

Thanks -

Joe

0 Kudos
HerbSmith
Level 9

Re: ePO 4.6 Patch 4 and Dat Reporting

Just to update and close this one out.   It took about a week but things came back down to normal levels of non compliant machines.   My guess is that something got changed in the ePO database.   Then when the machines sent in updated properties it got updated.

If i recall correctly the incorrect version being reported was from 3 to 6 months ago.   I could make no sense of the DAT being incorrectly reported.   Nor could I see a pattern to it.

Thanks

Herb

0 Kudos
McAfee Employee

Re: ePO 4.6 Patch 4 and Dat Reporting

Very strange, but at least things are back to normal. Thanks for letting us know

Joe

0 Kudos