7 Replies Latest reply on Sep 7, 2010 10:18 AM by haidvogg

    Updatetroubles (2 Positions) - McAfee ePO 4.5, Agent 4.5 - Enterprise 8.5.0i

      Hello!

       

      I got a strange problem within ePO 4.5 (Agent 4.5 used), which shows up in 2 different, seperated, domains.

       

      I installed ePO 4.5 and implemented a superdat file to test it (there is a client task for updating set) and it worked fine, except on one position. This position didn't want to accept the update and states that DAT version 5632.0000 is installed. I then updated the Agent, woke it up, updated again, updated manual from the client, updated using the Superdatfile directly ... no change. It reports that the update was successfull, but the dat files are still old ones. So it seems, that the update is kind of "stuck".

       

      I then uninstalled McAfee complete, rebooted the machine, deployed the agent new, ran the update again. Now the client shows a dat version, which is even lower than the one before (5215.0000)..

      So I went towards documents and settings - all users - application data - mcafee - common framework  and deleted the "updatehistory.ini" to provoke it to replicate completely new ... No change ...

       

      So, I ran out of ideas what I could furthermore test ... This is at the moment only a Test area with 7 clients in it, but used as an testarea from where the second ePO updates from (this ePO will then support 500 clients). In this Testarea already 2 clients show this beavior witht "wrong/outdated DAT Files". So I'm a little frightened, that in bigger measures, there will be a lot more clients with that problem ...

       

      I attached the logfiles I thought which might be helpfull.

       

      any ideas what to do to resolve this "stuck" state would be highly appreciated.

      thanks in advance,

       

      br Gerald

        • 1. Re: Updatetroubles (2 Positions) - McAfee ePO 4.5, Agent 4.5 - Enterprise 8.5.0i
          wwarren

          Trying for the simplest solution first -

          When you use a SuperDAT package, particularly one with "XDAT" in the name, be sure you reboot afterwards and before checking if the update was successful.

           

          Only after the reboot can you be assured that a SuperDAT update package has been applied.

          • 2. Re: Updatetroubles (2 Positions) - McAfee ePO 4.5, Agent 4.5 - Enterprise 8.5.0i

            I did that, as I was asked to reboot anyway. I rebooted now again to check, but still no change.

             

            Maybe a stupid question: I can't reboot all clients after every update (Domaincontrollers, client computers in use 24/7, ...). As those domains are a "high security" area without connection towards the internet, the sdat files seemed the best way to perform upgrades. Is there a different way where I don't have to reboot to be sure to have the correct updates?

             

            thanks, best regards

            G.

            • 3. Re: Updatetroubles (2 Positions) - McAfee ePO 4.5, Agent 4.5 - Enterprise 8.5.0i
              Attila Polinger

              Hello,

               

              did not see the superdat.log file, could you post it from the offending host (its in the TEMP dir if I remember correctly).

              Please state the time the superdat should run so we can patch timestamps from that log.

               

              Attila

              • 4. Re: Updatetroubles (2 Positions) - McAfee ePO 4.5, Agent 4.5 - Enterprise 8.5.0i

                Sorry for the late answer, wasn't  here since friday ...

                 

                Hm, I did another manual upgrade today, with new Sdat files, to check again. This time every position was updated properly ... I'm a little bit confused now, as it didn't work three days in a row, and after the weekend it works again.

                I'll keep it watched, as this is a little bit suspicious. But thanks anyway for your help so far

                 

                br, Gerald

                • 5. Re: Updatetroubles (2 Positions) - McAfee ePO 4.5, Agent 4.5 - Enterprise 8.5.0i

                  Ok. very very strange ...

                  today I started McAfee ePO, checked the status ... one of the 7 clients (one of those 2 which had the problem) had a DAT version rollback it seems. Yesterday all 7 where on 6096.000 ... today this one is on 5632.0000, while the others stayed on 6096.0000 ...

                   

                  I attached the superdat logfile I took yesterday. The time it was started was at 15:56 (3:56pm).

                   

                   

                  thanks, br,

                  Gerald

                  • 6. Re: Updatetroubles (2 Positions) - McAfee ePO 4.5, Agent 4.5 - Enterprise 8.5.0i
                    Attila Polinger

                    Hello,

                     

                    in the attached superdat.log it said it had not been able to in-place replace the engine because the old one was in use and a reboot was necessary. But you said you had rebooted the clients (perhaps including this one). I think a today's issue might not relate yesterday's troubleshooting fact, so I suggest let us not deal with superdat issue any longer if it is not necessary, but since in production you by all means won't rely on regularly deploying superdats, let us revert to usual updating client tasks.

                     

                    My questions:

                     

                    -. Is the "DAT file downgrades: Enable DAT file downgrades..." checkbox in the McAfee Agent policy that is applied to this client, set?

                    -. Is there a DAT and and engine checked in the master repository? What are the versions of them?

                    -. Are you using other repositories that might be checked beside the master repository? If so, are you sure they are up to date with the master repository?

                     

                    I suggest you schedule a repository pull task and use a client update task with the following enabled only: DAT, engine. Then schedule both (so the client task is run when repository is populated properly), and see if it makes a difference for this client. This will log its output in the McScript.log file which is the usual logfile to look at in such cases. Lets see what happens.

                     

                    Thank you.

                     

                    Attila

                    • 7. Re: Updatetroubles (2 Positions) - McAfee ePO 4.5, Agent 4.5 - Enterprise 8.5.0i

                      Hey Attila!

                       

                      To your questions:

                       

                      1) No, this checkbox is not set

                      2) No, till now there is only the SuperDAT Package availbable.(That is the easiest way for us to update this system, as there is no internet connection)

                      3) No, no other repositories. This is the only one that is used.

                       

                      The client task is no problem, the repository pull a big one As mentioned before, there is no internet connection available where the system could update through ...

                       

                      thanks, br

                      Gerald