cancel
Showing results for 
Search instead for 
Did you mean: 
mcdave
Level 10
Report Inappropriate Content
Message 1 of 6

querying (server) subtask logs

Hi,

I would like to query the details of subtasklogs.

We run daily agent deployment (server)tasks for non managed clients, but sadly enough there are many failing deployments (a few hundreds).
In the details of the subtasks of these servertasks logs I can find the reason of failture (access denied (wrong credentials), diskspace shotage, connection timeout, host doesn't exist, ...), but it's an enormous time consuming job to go through all these details of every (of the hondreds) subtask. (a lot of back and forward page clicking).

Is there a way to query this detailed information to get a quicker & clear overview.

regards,
Dave

5 Replies

Re: querying (server) subtask logs

I cannot believe that thier are no replies for this in over 2 years. This function would be greatly useful. 

I also ran into the issue of have multiple clients fail to update/upgrade to the latest version of McAfee Agent using the client deployment task. I have failers from not enough disk space, authentication failure, and host not found. It is really tasking to click into each subtask log to see the details. Is there really no query function that can put all this information into a spreadsheet format?

McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 3 of 6

Re: querying (server) subtask logs

I apologize that this was not answered when you first posted it.  We are working on improving responses to questions on the forums.

The agent only returns a success or failure status for the task.  Are these run from a run client task now, or from the product deployment section?  Since, as you noted, there are many reasons for a failure, the first place to look, unfortunately, is the client itself.  There are several types of failures.

1.  The task failed to invoke or client never received it

2.  Agent was not able to pull the files from repositories

3.  Once passed off to the installer, it fails to install for other local reasons

In the c:\programdata\mcafee\agent\logs directory (for 5.x agents), the masvc log will show whether the task actually invoked or not.  The mcscript log will show connections to repositories and whether it was able to reach your epo repositories and pull the files successfully.  If that occurs, then you will see it invoke the msi installer for the products and then the status or cause for failure would then be found in the install logs for the products.  Those are located in windows\temp\mcafeelogs.  That detail is never sent back to epo, as these are locally run tasks and installs, which generate only the local logging.

Re: querying (server) subtask logs

Thanks for the response cdinet. I am talking about the Run Now Client task.  The steps you provided, although good for checking the local logs, is not practical if I have to do that to more than 1 system at a time.  What I am talking about is somehow pulling the data out each clients log listed in the subtask tab of the server task log.

For example, the graph below shows 27 systems getting a McAfee Agent run now task. 11 failed and 10 expired. 

2/12/18 10:24:55 AMStarted: Deploy McAfee Agent to systems task
2/12/18 10:24:55 AMDeploying agents to 27 system(s)
2/12/18 10:31:41 AMCompleted: 6
2/12/18 10:31:41 AMFailed: 11
2/12/18 10:31:41 AMExpired: 10
2/12/18 10:31:41 AMCompleted: Deploy McAfee Agent to systems task (Completed: 6,Failed: 11,Expired: 10)

 

If I go to the subtasks tab I can see the client details...

Start Date

End Date

User Name

Status

Source

Duration

2/12/2018 10:25

2/12/2018 10:25

*******

Failed

Server Task

Less than a minute

2/12/2018 10:25

2/12/2018 10:25

*******

Failed

Server Task

Less than a minute

2/12/2018 10:25

2/12/2018 10:25

*******

Failed

Server Task

Less than a minute

2/12/2018 10:25

2/12/2018 10:31

*******

Stopped

Server Task

6 minutes

2/12/2018 10:25

2/12/2018 10:31

*******

Stopped

Server Task

6 minutes

2/12/2018 10:26

2/12/2018 10:31

*******

Stopped

Server Task

5 minutes

 

It's only at this point can I select a specific client log to see what happen. Why it Stopped or Failed.

The fails in this example shows that is does not have enough disk space...

2/12/2018 10:25Starting deployment to computer ********* through the Agent Handler *********
2/12/2018 10:25Error copying file C:\Windows\TEMP\mfe131121687.tmp\FramePkg.exe to \\*********\ADMIN$\FramePkg.exe, system error: There is not enough space on the disk.

 

The Stopped status shows...

2/12/18 10:25:00 AMStarting deployment to computer ********* through the Agent Handler *********
2/12/18 10:25:00 AMFailed to authenticate with remote system, system error: Access is denied.

 

What I want is the ability to query this data WITHOUT having to go into each client log. The best way I can explain it is to have the ability to query "Run Now Client Task = Deploy McAfee Agent" for "Status = Failed". Then, have the report show all the computers that failed with a column showing the details for each computer.  The closest thing I could find was the "Server Task Errors (last month) -> Failed" query. It shows the following data...

NameStart DateEnd DateUser NameStatusSource
Deploy McAfee Agent2/9/2018 12:052/9/2018 12:11********FailedServer Task
Deploy McAfee Agent2/9/2018 11:492/9/2018 11:56********FailedServer Task
Deploy McAfee Agent2/8/2018 10:162/8/2018 10:23********FailedServer Task

 

This is great to see what failed, but if the failed reason is different on each computer log, it would help to have an additional column with the "Details" of the failed log. For example, "Error copying file...not enough space on the disk."

Does that make sence?

McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 5 of 6

Re: querying (server) subtask logs

It makes perfect sense, but that detailed ability isn't there.  You can submit it for a feature modification or idea (kb60021).  You can pull some of the agent logs without having to go to the system if it is online.  Show agent log from the epo console, and when it comes up, there is a drop down to have the ability to show the different agent logs.  However, I don't believe that pulls the point product deployment logs.

Re: querying (server) subtask logs

Thanks for that info. I will submit a feature modification/idea request.