1 2 Previous Next 11 Replies Latest reply on Apr 19, 2010 10:26 AM by Sailendra Pamidi

    Rogue Sensor Install Issues

      My system has the agent installed. I wasn't able to install the RSS from ePO, so I did it manually. I am also unable to do Agent Wake Ups.

       

      This is from my log

       

      04-13-10 10:52:03,854 [3080] INFO RSDSensor <> - McAfee Rogue System Sensor 2.0.0 Build 405
      04-13-10 10:52:03,964 [3908] INFO RSDSensor <> - Starting sensor, true_main()
      04-13-10 10:52:04,464 [3908] ERROR RSDSensor <> - Failed to read configuration data (and no default available) for - ServerName.

      No virtual sensors will be created, and the sensor will go to sleep

      until a configuration change is detected.

       

      Can someone please help

        • 1. Re: Rogue Sensor Install Issues
          Sailendra Pamidi

          Hi,

            The Sensor needs key files (root.pem, sensor.pem, key.pem) which are sent by the ePO server as part of the RSD policy. Until these files are received by the sensor, it cannot communicate with the ePO server. You can check for the presence of these files in the RSD Installation folder: (C:\Program Files\McAfee\RSD Sensor).

           

          HTH,

          Sailendra

          1 of 1 people found this helpful
          • 2. Re: Rogue Sensor Install Issues

            Well I am now able to do agent wake-ups. Someone else set up group policies to be push out for windows firewall and that is what was blocking the agent wake-ups. I think it is also stopping me from doing the RSD install. I am going to look into that and post my findings.

            • 3. Re: Rogue Sensor Install Issues
              Sailendra Pamidi

              Very well - Agent wakeup port is not needed for RSD Install to succeed - please check if the agent is able to get the policy from ePO. If it does, then the key files would be sent as a part of that policy allowing the RSD Sensor to communicate to ePO on port 8444.

              1 of 1 people found this helpful
              • 4. Re: Rogue Sensor Install Issues

                The Agent is is getting the policies from ePO

                 

                Agent Subsystem 4/14/2010 9:35:27 AM Info Next policy enforcement in 5 minutes
                Agent Subsystem 4/14/2010 9:35:27 AM Info Agent finished Enforcing policies
                Management 4/14/2010 9:35:25 AM Info Enforcing Policies for McAfee Agent
                Management 4/14/2010 9:35:25 AM Info Enforcing Policies for EPOAGENT3000
                Management 4/14/2010 9:35:25 AM Info Enforcing Policies for EPOAGENT3000META
                Management 4/14/2010 9:35:25 AM Info Enforcing Policies for VIRUSCAN8700
                Agent Subsystem 4/14/2010 9:35:25 AM Info Agent Started Enforcing policies
                Agent Subsystem 4/14/2010 9:35:12 AM Info Agent is looking for events to upload

                But when I set up ePO i was instructed to set up my ports like this

                 

                Agent-to-server communication port:  80
                Agent wake-up communication port:  591
                Agent broadcast communication port:  8082
                Event parser-to-application server communication port:  8445 
                Console-to-application server communication port:  443
                Sensor-to-server communication port:  8443

                Plus I am pretty sure 8444 is being blocked by the firewall

                • 5. Re: Rogue Sensor Install Issues

                  In the RSDSensor_out.log this is what I get

                   

                  04-14-10 13:03:30,800 [1540] INFO RSDSensor <> - McAfee Rogue System Sensor 2.0.0 Build 405
                  04-14-10 13:03:30,893 [3744] INFO RSDSensor <> - Starting sensor, true_main()
                  04-14-10 13:03:31,657 [3744] ERROR RSDSensor <> - Failed to read configuration data (and no default available) for - ServerName.

                  No virtual sensors will be created, and the sensor will go to sleep

                  until a configuration change is detected.


                  Thats if I manually install RSD on one of my workstations. I still can't get it to in stall from ePO.

                  • 6. Re: Rogue Sensor Install Issues

                    I am still not having any luck with my RSD install, no mater if it is manully or from the ePO. If i do it manully I can see it installed at my ePO, but there is no communication between the two. Has any one else had this problem?

                     

                     

                    Message was edited by: newtothis on 4/15/10 12:11:46 PM CDT
                    • 7. Re: Rogue Sensor Install Issues
                      Sailendra Pamidi

                      Please attach the entire sensor log here. (RSSensor_out.log). Also, do you see any .PEM files in the sensor folder? Until those files are present, sensor wont attempt communicating to ePO.

                      Since you seem to have customized the Sensor to Server communication Port to 8443 during ePO installation (default is 8444) firewall blocking 8444 may not be of concern.

                       

                      Along with the Sensor log, also gather the Agent log (Agent_<machine>.log) from the agent data folder (Documents and Settings\All users\Application data\McAfee\Common Framework\DB)

                       

                      - Sailendra

                      • 8. Re: Rogue Sensor Install Issues

                        Sailendra,

                         

                        I re-imaged the computer i manually did the install on. I even disabled the firewall and then tried to do an install from the ePO. So there is no RSSensor_out.log and no .PEM files. What I don't understand is everything was working fine and then we pushed out a new image to all of the workstations (with a new name scheme) and when I tried to install the RSS on the new image it didn't work. But there is also a few other admin and we all handle different areas, Thats why the fire wall was blocking the agent wake-up.

                         

                        Here is the agent log from the new imaged workstation.

                        • 9. Re: Rogue Sensor Install Issues
                          Sailendra Pamidi

                          From the log it looks like you are using Windows 7 as the client OS? If yes, please ensure that you have the most recent version of MA 4.0 Extension or MA 4.5 extension checked into the ePO repository.

                           

                          Review KB67594 for more details.

                           

                          Also, RSD Sensor is not in the list of products that the agent is enforcing policies for - so there is no policy received from ePO for the RSD Sensor (Product code should be SNOWCAPXXXXX)

                           

                          For a list of supported platforms for RSD 2.0 Sensor, please refer KB53815

                          1 of 1 people found this helpful
                          1 2 Previous Next