7 Replies Latest reply on Apr 1, 2010 1:58 AM by Attila Polinger

    Rogue Sensor Problem

      Hi,

       

      I have a problem deploying McAfee rogue sensor 4.5.  The task is created and the agent monitor says the installation was sucessful however the service never starts, can anyone help me with this please?

       

      regards

       

      Adrian

        • 1. Re: Rogue Sensor Problem
          Attila Polinger

          Hi,

           

          I checked on our system and no such client task as Rogue Sensor deployment couild be created. How did you do that?

           

          Attila

          • 2. Re: Rogue Sensor Problem

            Hi Attila

             

            If you look in select a system in the system tree and then from the menu select Actions > Agent > Modify tasks on a single system you will see the task (after you have clicked 'install rogue sensor' of course :-)

             

            Adrian

            • 3. Re: Rogue Sensor Problem
              Attila Polinger

              Hi Adrian,

               

              Actually I can see another category in Actions : Rogue System Sensor, and there can I find the Install Sensor which possibly will create the task.

              I'd like to mention that we upgraded our test ePO 4.0 to 4.5, which preserved the wrong RSD install set in the master repo. I had to manually check the RSD sensor 4.5 afterward. Would you check if you have an RSD 4.5 install in master repo? Or check if you have the same catwegory in Action menu?

               

              Attila

              • 4. Re: Rogue Sensor Problem

                Hi Attila,

                 

                Yes the 'rogue sensor' > 'install rogue sensor' is the action i took to create that task.

                 

                This is a clean install of EPO 4.5 and yes Rogue sensor 4.5 is the only one listed.  Rogue sensor has installed sucessfully on 9 systems already but has failed on about 10 subsequent attempts, almost like there was a limit on the total number of systems allowed?  (They are all on different subnets)

                 

                Adrian

                • 5. Re: Rogue Sensor Problem
                  Attila Polinger

                  Hi,

                   

                  several logs exist where you can find related information, I do not know when you have installed the sensors so server logs may not be the best place to look, but you can check the actual destination host, where you deployed the sensor foer either install MSI log or other information, like event log, to find out about the failure.

                   

                  I would check that the host is an active RSD sensor or not (likely not), then I would check the RSD sensor install MSI log RSDSEN450-Install-MSI.log on the destination host in %temp%\McAfeeLogs folder. Then check the event log (if MSI log does not show any failure to install message), why the sensor service did not start (close to a reboot event).

                   

                  Attila

                  1 of 1 people found this helpful
                  • 6. Re: Rogue Sensor Problem

                    Hi Attila,

                     

                    Thanks for the info, however no log exists (see attached snip). I rebooted and still no service running.

                     

                    I have noticed that on a sucseeful rogue sensor install the McAfee status monitor shows the packages being decompressed and 'snowcap' being installed etc. however when the install fails status monitor just goes straight to 'rogue sensor deployment sucessful' as if it is looking for the install files in the wrong place and then just quitting perhaps?

                     

                    Adrian

                    • 7. Re: Rogue Sensor Problem
                      Attila Polinger

                      Hi,

                       

                      would you please retry the RSD sensor install, and then post McScript.log from the destination host (telling the time when install took place)? I'd like to take a look. Be sure to set - first - loglevel 8 on the destination host (see KB58966) so this log contains more messages.

                       

                      Attila