2 Replies Latest reply on Aug 25, 2010 9:37 AM by strmcrow

    Agent Stops Reporting In - Reload of Agent Does Not Work

    strmcrow

      I  have two servers, both Win2003R2, that decided to stop reporting in to the ePO server. There was a twelve hour interval between the two servers stopping their reporting. Both servers are on the same subnet behind the same firewall. If there was a firewall issue, I would think they would have stopped at the same time. They ARE able to get DAT updates from the same ePO server.

       

      Reloading the agent did not do anything. The server were running agent 4.5.0. I went back to agent 4.0.0. Still no response.

       

      Here's some odd observations. When I bring up the cmdagent /s GUI and the McAfee system tray icon tray turns over to the little 'M' shield, as I call it, I click on it and bring up the "About..." information panel. Despite the fact that Virusscan, Antispyware, HIPS and a few other plugins are all installed, not ONE shows up in this "About..." like the other servers do.

       

      Here's the McTray log:

       

      129271950037340000|2|Error Logging Plugin|The trusted partner verification DLL is not a McAfee trusted DLL.|8/25/2010  7:30:03 AM|
      129271950038280000|2|McTray Legacy Support Plugin|The trusted partner verification DLL is not a McAfee trusted DLL.|8/25/2010  7:30:03 AM|
      129271950038750000|2|VirusScan Enterprise Plugin|The trusted partner verification DLL is not a McAfee trusted DLL.|8/25/2010  7:30:03 AM|

       

      Anyone ever seen this?

       


      What it comes down to is that I have two servers out of three hundred clients that no longer want to report in despite having all McAfee software removed, reinstalled and the agent put back on.

       

      No change to the OS has been done.

        • 1. Re: Agent Stops Reporting In - Reload of Agent Does Not Work
          JoeBidgood

          I have a case open for another customer with this issue, which is currently being looked at by the developers. The "...DLL is not a McAfee trusted DLL" message is apparently caused because the agent can't load its DLLs, but I haven't been able to reproduce the behaviour.

          Just to confirm - uninstalling and reinstalling the agent has no effect, is that correct? And neither does reverting to version 4?

           

          Finally - I know you hear this a lot from support folks, but bear with me - it's unlikely that two agents would spontaneously fail in the same, highly-uncommon way, within a few hours of each other. Can you think of anything on these machines that could have changed? Were any patches installed, or new software, or new hardware? Any changes to group policies?

           

          Thanks -

           

          Joe

          • 2. Re: Agent Stops Reporting In - Reload of Agent Does Not Work
            strmcrow

            Right. Re-installing the agent fixed neither problem; that being the empty McTray "About..." and the reporting problems.

             

            I'm going to attach an Excel spreadsheet which shows something interesting concerning patches. I'll explain. SERVER1, which is no longer reporting in and has the McTray problem, had eleven patches installed the very day that it stopped reporting in. Those patches, listed by their KB number are listed under the SERVER1 column.

             

            I then compared those to SERVER2, the second server that has stopped reporting in, BUT has FULL McTray information. It also had patches installed the same day, but there is a difference of three less on SERVER2 than SERVER1.

             

            I then went to two other servers (SERVER 3 and 4) that are having NO problems whatsoever. Same patches as SERVER2, except they were installed in a different day.

             

            I'm still looking elsewhere.

             

            Ideas?