6 Replies Latest reply on Apr 20, 2010 6:56 AM by Omnicube

    9k clients not updating DAT since March 31st

      We currenlty experiencing issues with Virusscan not updating clients on about 95% of our machines. We are running Virusscan 8.7i with ePO 4.0 and agent 4.0.  Now according to the EOL articles these versions SHOULD not be affected, but they were.

      We have tested some and found that if we upgrade the ePO agent to 4.0.1494 the issues is resolved. Or if we delete or rename the V2datdet.mcs file then run autoupdate the update continues.

      We currently have level 2 looking at the issue, but wanted to see if anyone here has experienced the issues.

       

      All repo's are up to date with latest files, and replication, ePO services and all other aspects of ePO are working correctly. It looks like it's just an issue on the client side.

       

      Example of log file on affected machine:

       

      4/7/2010              07:07:37 AM       CORP\USER               Starting task: AutoUpdate
      4/7/2010              07:07:38 AM       CORP\USER               Checking update packages from repository *************.
      4/7/2010              07:07:38 AM       CORP\USER               Initializing update...
      4/7/2010              07:07:38 AM       CORP\USER               Verifying catalog.z.
      4/7/2010              07:07:38 AM       CORP\USER               Extracting catalog.z.
      4/7/2010              07:07:38 AM       CORP\USER               Loading update configuration from: catalog.xml
      4/7/2010              07:07:39 AM       CORP\USER               These updates will be applied if they are in the repository:  Engine, DAT, VSCANCEU1000, EXTRADAT1000, BOCVSE__1000, VIRUSCAN8700.
      4/7/2010              07:07:39 AM       CORP\USER               Downloading PkgCatalog.z.
      4/7/2010              07:07:39 AM       CORP\USER               Verifying PkgCatalog.z.
      4/7/2010              07:07:39 AM       CORP\USER               Extracting PkgCatalog.z.
      4/7/2010              07:07:39 AM       CORP\USER               Loading update configuration from: PkgCatalog.xml
      4/7/2010              07:07:40 AM       CORP\USER               Verifying V2engdet.mcs.
      4/7/2010              07:07:40 AM       CORP\USER               Downloading V2engdet.mcs.
      4/7/2010              07:07:43 AM       CORP\USER               Error occurred while downloading C:\ProgramData\McAfee\Common Framework\Current\VSCANENG1000\PkgCatalog.z.
      4/7/2010              07:07:43 AM       CORP\USER               Downloading PkgCatalog.z.
      4/7/2010              07:07:43 AM       CORP\USER               Verifying PkgCatalog.z.
      4/7/2010              07:07:43 AM       CORP\USER               Extracting PkgCatalog.z.
      4/7/2010              07:07:43 AM       CORP\USER               Loading update configuration from: PkgCatalog.xml
      4/7/2010              07:07:44 AM       CORP\USER               Verifying V2datdet.mcs.
      4/7/2010              07:07:44 AM       CORP\USER               Downloading V2datdet.mcs.
      4/7/2010              07:07:46 AM       CORP\USER               Error occurred while downloading C:\ProgramData\McAfee\Common Framework\Current\VSCANDAT1000\PkgCatalog.z.
      4/7/2010              07:07:46 AM       CORP\USER               Verifying DATDet.mcs.
      4/7/2010              07:07:46 AM       CORP\USER               Searching available updates for DATs.
      4/7/2010              07:07:46 AM       CORP\USER               Product(s) running the latest ExtraDAT.
      4/7/2010              07:07:46 AM       CORP\USER               Verifying BocDet_VSE.McS.
      4/7/2010              07:07:46 AM       CORP\USER               Downloading BocDet_VSE.McS.
      4/7/2010              07:07:46 AM       CORP\USER               Searching available updates for BOC DAT.
      4/7/2010              07:07:46 AM       CORP\USER               Downloading PkgCatalog.z.
      4/7/2010              07:07:46 AM       CORP\USER               Verifying PkgCatalog.z.
      4/7/2010              07:07:46 AM       CORP\USER               Extracting PkgCatalog.z.
      4/7/2010              07:07:46 AM       CORP\USER               Loading update configuration from: PkgCatalog.xml
      4/7/2010              07:07:47 AM       CORP\USER               Starting BOC DAT update.
      4/7/2010              07:07:47 AM       CORP\USER               Downloading vscan.bof.
      4/7/2010              07:07:48 AM       CORP\USER               Update succeeded to version 493.
      4/7/2010              07:07:48 AM       CORP\USER               Verifying VSE870Det.McS.
      4/7/2010              07:07:48 AM       CORP\USER               Searching available updates for McAfee VirusScan Enterprise 8.7.0.
      4/7/2010              07:07:48 AM       CORP\USER               Updates were not applied because packages were not in the repository: VSCANCEU1000.
      4/7/2010              07:07:49 AM       CORP\USER               Update Finished

       

      Appreciate any assistance.

       

      Thanks

       

       

      Message was edited by: Omnicube on 4/8/10 9:44:30 AM CDT

       

       

      Message was edited by: Omnicube on 4/8/10 9:55:43 AM CDT
        • 1. Re: 9k clients not updating DAT since March 31st

          I haven't seen this, but am wondering if it's the installation of 4.0.1494 that resolves the issue, or *just* the re-installation of the EPO Agent that resolves the issue.

           

          If deleting V2datdet/v2engdet.mcs resolves the issue, then potentially second tier support can create a superdat which does just that.You would then be able to deploy via EPO etc.

           

          Is deleting the dat files out of the repository, replicating, and then adding them again (either via a pull or downloading/importing the dat package from http://www.mcafee.com/apps/downloads/security_updates/packages.asp?region=us&seg ment=enterprise ) a viable option? Might help to convince the clients to download datdet/engdet again. Perhaps try checking in the dat package into an evaluation branch and seeing if some test clients that are assigned to update from Evaluation sort out their files.

          • 2. Re: 9k clients not updating DAT since March 31st
            rmetzger

            Hi Omnicube,

             

            Just a thought:

            Did you follow the directions in https://kc.mcafee.com/corporate/index?page=content&id=KB60772&pmv=print which instructed us to change to the new V2 sites?

            What is the location of the new V2-only CommonUpdater site?
            The new V2-only CommonUpdater download site can be accessed via FTP or HTTP from either:

             

            If so, as I did, I found that the updates stopped working on April 1, 2010. Changing it back to

            corrected the updates.

             

            I hope this helps.

            Ron Metzger

            • 3. Re: 9k clients not updating DAT since March 31st

              Thanks for your replies.

               

              We have tried removing all contents from a repository and deleting the package off of the ePO server. After downloading new packages and replicating a fresh copy, the agents still do not receive the udpates.  I have found a few articles pointing at the version number where it was having issues with catalog.z not copying due to size. Also a few reports of the 1421 version having similiar issues to what we are experiencing.

               

              I have tested utilizing the new download source and the old one as well. In both places the files are downloaded and updated in ePO and on the repositories, but the clients still do not see them.

               

              We are still awaiting a response from level 2 support, but i'm starting to think that the agent upgrade is our only choice. I like the idea of a superDAT to delete the file, but we might as well utilize SCCM to push the agent.  I have seen where the new agent update does replace the v2datdet.mcs file with a newer version, so i'm assuming McAfee missed the connection with the V2 EOL update and the ePO agent.

               

              All will solved hopefully with help from level 2.  I will definitely come back and resond with our findings and solutions.

               

              Thanks

              • 4. Re: 9k clients not updating DAT since March 31st

                Hi There,

                 

                we have the same Problems with the DAT update.

                 

                McAfee Agent in Version 4.0.0.1421 with Vscan Enterprise in Version 8.5.i Patch 8 and ePO 4.0.

                Since March 31st there are about 700 from 1200 Client not able to update the latest Pattern.

                 

                I look forward to contact the McAfee Support too. Have you got any feedback to your Call ?

                 

                Thanks in advanced !!

                 

                Konrad

                • 5. Re: 9k clients not updating DAT since March 31st

                  Thanks all for the replies.

                   

                  After working with McAfee support and having our ticket go up to tier III support, the conclusion was that hte agent version needed to be upgraded. Apparently the issue lies with a bug in 1421 that keeps updates from downloading from UNC repositories. Their only advice was to update the agents to the latest build. Honestly to me this is not believeable. There is too much coincedience between the March 31st timeframe, EOL on some mcafee products and my agents not updating. But of course they were not going to give out anymore information.

                   

                  HOWEVER..I was able to determine that if you delete the deldat.mcs file the agent will update, pull down the new version and continue to update. I made McAfee create me a superdat that was pushed out to all clients that deleted this file for me. I set up the SDAT pull about 10 minutes before normal DAT update schedule. After a few days we have about 90% of all 9000 machiens being updated now.

                   

                  The only action we have left now is to update the agents, but we can now take our time on this as everythign is working almost 100%.

                   

                  Hope others can use this information to get the issue resolved for them.

                  • 6. Re: 9k clients not updating DAT since March 31st
                    jmcleish

                    Omnicube,

                    just so you think its not a conspiracy....

                     

                    There is too much coincedience between the March 31st timeframe, EOL on some mcafee products and my agents not updating. But of course they were not going to give out anymore information.

                     

                    It is coincidence.

                    I discovered that bug months ago and had to upgrade all my clients. I now have http repos.

                    :-(

                     

                    Jane