cancel
Showing results for 
Search instead for 
Did you mean: 
a2wa2
Level 8

not to get DAT and engine Updates

Hello friends

I have problem with some of my computers, after a holiday for 3 or 4 days some of my computers not get DAT and engine's update and I check their communication and the last communication is remained but they are not get updates.

so I should remote them and uninstall virus scan and remove agent manually and deploy agent again and it is not rational for 300 computers!!! what should I solve my problem ? I am tired of lost last communication and updating virus scan, I search a lot but not reach the correct answer.

my epo is 5.3 and my agent is 5.0.5.658

best regards

0 Kudos
8 Replies
Daniel_S
Level 12

Re: not to get DAT and engine Updates

So if I understand you correctly your agents are still reporting to EPO but don´t do the Update-Tasks?

What do you see on the Agent-Monitor when you push the task from your EPO-console? Do they even reply?

You state that it only happens on a few machines!? What is the difference to the others? Same network as the EPO or maybe DMZ?

Do they directly communicate with the EPO or with an Agenthandler?

Best regards

Dan

Best regards
Dan
0 Kudos
Dutchman39
Level 10

Re: not to get DAT and engine Updates

Only SOME, right?

Do they share the same (internal) repository? Perhaps you have a 'stuck' update task?

0 Kudos
a2wa2
Level 8

Re: not to get DAT and engine Updates

yes it is

yes they have same repository in same condition

0 Kudos
a2wa2
Level 8

Re: not to get DAT and engine Updates

1)yes it is,

2)my reply from epo DB log indicate the agent has communication with epo but when I run wake up task it failed with the log below,x is my system that have this problem.

20170620090235I#04640NAIMSERVReceived [PropsVersion] from X:
20170620090235I#04640NAIMSERVProcessing agent props for X()
20170620090235I#04640NAIMSERVSending props response for agent X 6, agent has up-to-date policy
20170620090235I#04640MOD_EPOepo request processed, rc=202, session ID=49362, session time=62ms
20170620090237I#04640NAIMSERVReceived [PolicyManifestRequest] from X:{A}
20170620090237I#04640NAIMSERVSigning agent response package with key
20170620090237I#04640MOD_EPOepo request processed, rc=0, session ID=49363, session time=63ms

when I wake up it , indicate below 

20170620143209E#06520NAIMSERVnaSPIPE.cpp(338): Failed to connect to Xip, network error was 10060
20170620143212I#04656MOD_EPOREPOReceived request, uri=/Software/SiteStat.xml, remoteIP=Y
20170620143213E#06520NAIMSERVnaSPIPE.cpp(338): Failed to connect to X 1, network error was 10061
20170620143214I#05144MOD_EPOREPOReceived request, uri=/Software/Current/VSCANENG1000/Engine/0000/replica.log, remoteIP=Y
20170620143214E#06520NAIMSERVnaSPIPE.cpp(338): Failed to connect to X, network error was 10061
20170620143214I#06520NAIMSERVWake up agent on DNS name X
20170620143215E#06520NAIMSERVnaSPIPE.cpp(338): Failed to connect toX, network error was 10061
20170620143217E#06520NAIMSERVnaSPIPE.cpp(338): Failed to connect to X, network error was 10061
20170620143218E#06520NAIMSERVnaSPIPE.cpp(338): Failed to connect to X, network error was 10061
20170620143218I#06520NAIMSERVWake up agent on NetBIOS name X...
20170620143219E#06520NAIMSERVnaSPIPE.cpp(338): Failed to connect toX, network error was 10061
20170620143220I#05232MOD_EPOREPOReceived request, uri=/Software/Current/VSCANDAT1000/DAT/0000/replica.log, remoteIP=Y

3)there is no difference between them and they are in same condition

4)how can I check it?

0 Kudos
a2wa2
Level 8

Re: not to get DAT and engine Updates

20170620143248E#06520NAIMSERVnaSPIPE.cpp(338): Failed to connect to x, network error was 10061
20170620143248E#06520NAIMSERVAgentWakeup.cpp(206): Server failed to wake up x, detailed error = -999
0 Kudos
a2wa2
Level 8

Re: not to get DAT and engine Updates

my agent is 5.0.5.658 and vse is 8.8.8 patch9 would u please help me which log is related to my problem  in computer side?

0 Kudos
a2wa2
Level 8

Re: not to get DAT and engine Updates

also some of my agents lost their communication with this log after a while and in approximately 1 month It lost communication but when I check the mcafee folder in these path C:\Program Files\McAfee and C:\Program Files (x86)\McAfee all the products are compeletly exist and there is no firewall and another antivirus working.what is the problem?

2017-05-17 15:51:19.609 macompatsvc(8656.9008) ma_client.Debug: Removing epo.client.datachannel.MCDATREP1000 to client manager.

2017-05-17 15:51:19.609 macompatsvc(8656.9008) msgbus.Debug: Unsubscribing (outer) topic filter <epo.datachannel.delivery.notification>...

2017-05-17 15:51:19.609 macompatsvc(8656.9008) msgbus.Debug: Submitting loop worker request to unsubscribe topic filter <epo.datachannel.delivery.notification>

2017-05-17 15:51:19.610 macompatsvc(8656.9008) msgbus.Debug: Subscriber <epo.datachannel.delivery.notification> releasing

2017-05-17 15:51:19.610 macompatsvc(8656.9008) datachannel_client.Debug: Client [ MCDATREP1000 ] removed from client manager

2017-05-17 15:51:19.610 macompatsvc(8656.9008) schedulerclient.Debug: product id(MCDATREP1000) removed successfully

2017-05-17 15:51:19.610 macompatsvc(8656.9008) cma.Info: Compat client = MCDATREP1000 stopped.

2017-05-17 15:51:19.610 macompatsvc(8656.9008) compatbase.Info: Stopping manageability client for the application VIRUSCAN8800

2017-05-17 15:51:19.610 macompatsvc(8656.9008) ma_client.Debug: Removing ma.client.property.VIRUSCAN8800 to client manager.

2017-05-17 15:51:19.611 macompatsvc(8656.9008) msgbus.Debug: Unsubscribing (outer) topic filter <ma.property.collect>...

2017-05-17 15:51:19.611 macompatsvc(8656.9008) msgbus.Debug: Submitting loop worker request to unsubscribe topic filter <ma.property.collect>

2017-05-17 15:51:19.611 macompatsvc(8656.9008) msgbus.Debug: Subscriber <ma.property.collect> releasing

2017-05-17 15:51:19.611 macompatsvc(8656.9008) ma_client.Debug: Removing ma.client.policy.VIRUSCAN8800 to client manager.

2017-05-17 15:51:19.611 macompatsvc(8656.9008) ma_client.Debug: Removing epo.client.datachannel.VIRUSCAN8800 to client manager.

2017-05-17 15:51:19.612 macompatsvc(8656.9008) msgbus.Debug: Unsubscribing (outer) topic filter <epo.datachannel.delivery.notification>...

2017-05-17 15:51:19.612 macompatsvc(8656.9008) msgbus.Debug: Submitting loop worker request to unsubscribe topic filter <epo.datachannel.delivery.notification>

2017-05-17 15:51:19.612 macompatsvc(8656.9008) msgbus.Debug: Subscriber <epo.datachannel.delivery.notification> releasing

2017-05-17 15:51:19.612 macompatsvc(8656.9008) datachannel_client.Debug: Client [ VIRUSCAN8800 ] removed from client manager

2017-05-17 15:51:19.612 macompatsvc(8656.9008) schedulerclient.Debug: product id(VIRUSCAN8800) removed successfully

2017-05-17 15:51:19.613 macompatsvc(8656.9008) schedulerclient.Debug: releasing scheduler client

2017-05-17 15:51:19.613 macompatsvc(8656.9008) ma_client.Debug: Removing ma.client.scheduler to client manager.

2017-05-17 15:51:19.613 macompatsvc(8656.9008) schedulerclient.Debug: scheduler client released

2017-05-17 15:51:19.613 macompatsvc(8656.9008) cma.Info: Compat client = VIRUSCAN8800 stopped.

2017-05-17 15:51:19.613 macompatsvc(8656.9008) compatbase.Info: Removing manageability client for the application MCDATREP1000

2017-05-17 15:51:19.613 macompatsvc(8656.9008) plugin.Info: Plugin deinitialize rc = 0.

2017-05-17 15:51:19.614 macompatsvc(8656.9008) plugin.Info: Deinitialize plugin C:\Program Files (x86)\Common Files\McAfee\DATReputation\mgmtplugin\datrepmp.dll.

2017-05-17 15:51:19.715 macompatsvc(8656.9008) compatbase.Info: Removing manageability client for the application VIRUSCAN8800

2017-05-17 15:51:19.715 macompatsvc(8656.9008) plugin.Info: Plugin deinitialize rc = 0.

2017-05-17 15:51:19.715 macompatsvc(8656.9008) plugin.Info: Deinitialize plugin C:\Program Files (x86)\McAfee\VirusScan Enterprise\VsPlugin.dll.

2017-05-17 15:51:19.727 macompatsvc(8656.9008) compatservice.Info: stopped client manager.

2017-05-17 15:51:19.727 macompatsvc(8656.9008) msgbus.Debug: Unsubscribing (outer) topic filter <ma.compat.launcher.updaterui>...

2017-05-17 15:51:19.728 macompatsvc(8656.9008) msgbus.Debug: Submitting loop worker request to unsubscribe topic filter <ma.compat.launcher.updaterui>

2017-05-17 15:51:19.728 macompatsvc(8656.9008) msgbus.Debug: Subscriber <ma.compat.launcher.updaterui> releasing

2017-05-17 15:51:19.728 macompatsvc(8656.9008) cma.Info: unregister for policy notification.

2017-05-17 15:51:19.728 macompatsvc(8656.9008) ma_client.Debug: Removing ma.client.policy.EPOAGENT3000 to client manager.

2017-05-17 15:51:19.729 macompatsvc(8656.9008) cma.Info: stopping ma client...

2017-05-17 15:51:19.729 macompatsvc(8656.9008) ma_client.Info: stopping ma client.

2017-05-17 15:51:19.729 macompatsvc(8656.9008) msgbus.Debug: Unsubscribing (outer) topic filter <ma.*>...

2017-05-17 15:51:19.729 macompatsvc(8656.9008) msgbus.Debug: Submitting loop worker request to unsubscribe topic filter <ma.*>

2017-05-17 15:51:19.730 macompatsvc(8656.9008) cma.Info: stopping msgbus...

2017-05-17 15:51:19.730 macompatsvc(8656.9008) msgbus.Debug: Message bus stop...

2017-05-17 15:51:19.730 macompatsvc(8656.9008) msgbus.Debug: ma_msgbus_stop invoked from i/o thread

2017-05-17 15:51:19.730 macompatsvc(8656.9008) msgbus.Debug: Stopping msgbus...

2017-05-17 15:51:19.730 macompatsvc(8656.9008) msgbus.Debug: Stopped local broker

2017-05-17 15:51:19.731 macompatsvc(8656.9008) msgbus.Debug: submitted request to loop worker for request manager stop

2017-05-17 15:51:19.731 macompatsvc(8656.9008) msgbus.Debug: Stopped loop worker

2017-05-17 15:51:19.731 macompatsvc(8656.9008) msgbus.Debug: Send all the messages from connection Q..

2017-05-17 15:51:19.731 macompatsvc(8656.9008) msgbus.Debug: named pipe <\\.\pipe\ma_5bd9fa52-9d71-e8fd-20b0-306ab91d3db1_5348.00000000015A44C0_289592267> connection takes sometime to send pending messages

2017-05-17 15:51:19.731 macompatsvc(8656.9008) msgbus.Debug: named pipe connection manager closed all the connections

2017-05-17 15:51:19.731 macompatsvc(8656.9008) msgbus.Debug: Closed named pipe connection manager

2017-05-17 15:51:19.732 macompatsvc(8656.9008) msgbus.Debug: OK, stopped msgbus, now waiting for loop to run dry

2017-05-17 15:51:19.732 macompatsvc(8656.9008) cma.Info: stopped msgbus...

2017-05-17 15:51:19.732 macompatsvc(8656.9008) cma.Debug: Destroying VIRUSCAN8800 task status poller.

2017-05-17 15:51:19.732 macompatsvc(8656.9008) cma.Debug: Destroying MCDATREP1000 task status poller.

2017-05-17 15:51:19.733 macompatsvc(8656.9008) msgbus.Debug: Unsubscribing (inner) topic filter <ma.property.collect>

2017-05-17 15:51:19.733 macompatsvc(8656.9008) msgbus.Debug: Subscriber <ma.property.collect> Unregistration

2017-05-17 15:51:19.733 macompatsvc(8656.9008) msgbus.Debug: Message created for Unregistration of <ma.property.collect> subscriber

2017-05-17 15:51:19.733 macompatsvc(8656.9008) msgbus.Debug: <ma.msgbus.pubsub_service.service> service found in router

2017-05-17 15:51:19.733 macompatsvc(8656.9008) msgbus.Debug: Service <ma.msgbus.pubsub_service.service> found in local search and status of ep lookup is <2>

2017-05-17 15:51:19.733 macompatsvc(8656.9008) msgbus.Debug: Calling lookup callback in async way with status <0> from ep lookup <0193B648>

2017-05-17 15:51:19.734 macompatsvc(8656.9008) msgbus.Debug: uv timer data(0193D428)

2017-05-17 15:51:19.734 macompatsvc(8656.9008) msgbus.Debug: Subscriber <ma.property.collect> destroying...

2017-05-17 15:51:19.734 macompatsvc(8656.9008) cma.Info: msgbus stopped ...

2017-05-17 15:51:19.734 macompatsvc(8656.9008) compatservice.Info: stopped compat service context.

2017-05-17 15:51:19.735 macompatsvc(8656.9008) msgbus.Debug: Subscriber <ma.*> releasing

2017-05-17 15:51:19.735 macompatsvc(8656.9008) msgbus.Debug: Message bus release...

2017-05-17 15:51:19.735 macompatsvc(8656.9008) msgbus.Debug: message bus destroying

2017-05-17 15:51:19.735 macompatsvc(8656.9008) msgbus.Debug: local broker Releases

2017-05-17 15:51:19.735 macompatsvc(8656.9008) msgbus.Debug: Name pipe server destroys

2017-05-17 15:51:19.736 macompatsvc(8656.9008) msgbus.Debug: local broker destroyed

2017-05-17 15:51:19.736 macompatsvc(8656.9008) msgbus.Debug: named pipe connection manager destroying...

2017-05-17 15:51:19.736 macompatsvc(8656.9008) msgbus.Debug: ma_named_pipe_connection_release, ref count <3>

2017-05-17 15:51:19.736 macompatsvc(8656.9008) msgbus.Debug: named pipe connection manager cleared

2017-05-17 15:51:19.736 macompatsvc(8656.9008) loop_worker.Debug: Loop worker destroys

2017-05-17 15:51:19.737 macompatsvc(8656.9008) macompatsvc.Info: MA compat service returned from msg loop, continuing shutdown.

2017-05-17 15:51:19.737 macompatsvc(8656.9008) macompatsvc.Info: Stopped Service

0 Kudos
McAfee Employee

Re: not to get DAT and engine Updates

The logs you want to look at is the mcscript and masvc log on the client for update failures.  Masvc will show when the task invoked and the mcscript log will show which repository it tried and any failures/successes.  You might want to open a case with McAfee rather than posting potential internal company info with system names, ip's, etc. on a public forum.

0 Kudos