9 Replies Latest reply on Dec 9, 2010 7:09 AM by Attila Polinger

    ePO 4.0 HTTP Pull not updating to latest DAT

      Hi All,

       

      I have some issues with our ePO 4. It seems that it is skipping the DAT updates. Although the PULL task from McAfee is scheduled to update everyday, it does not download the latest DAT. Let me elaborate on the situation further.

       

      The Server is based in Switzerland (GTM+1). It is schedule to PULL updates from update.nai.com/Products/CommonUpdater2 every 1715Hrs, 1815Hrs and 1915Hrs. The ePO server than have serveral PUSH task to other sites. From the update.nai.com, I can see that the current latest DAT is 6176. But on my server the current DAT is 6175 and the previous DAT is 6172. The reason why the current DAT is 6175 is because I had ran a manual PULL Task yesterday at 0100 Hrs. From the task log in EPO, I realised that it did not check for "current/vscandat1000/dat/0000/". In the schedule task ACTION, DAT was in fact selected.

       

      Frankly speaking, I am pretty new to ePO as I was working on Trend Micro previously. Any help is greatly appreciated and thanks ahead!!

       

      ================================================PULL Task Log==========================================================================


      McAfeeHttp 2010-11-23 19:52:50.957 INFO Skipping package Current\FSCANENG1000\5400.2003\Engine\\0000, not selected for selective pull
      McAfeeHttp 2010-11-23 19:52:50.963 INFO Skipping package Current\LMASECORE2000\2.2.0.9286\SpamEngine\\0000, not selected for selective pull
      McAfeeHttp 2010-11-23 19:52:50.983 INFO Skipping package Current\MASECORE2000\2.2.0.9286\SpamEngine\\0000, not selected for selective pull
      McAfeeHttp 2010-11-23 19:52:50.99 INFO Skipping package Current\ENCPTCNT6000\7.0.0.3429\DAT\\0000, not selected for selective pull
      McAfeeHttp 2010-11-23 19:52:50.993 INFO Skipping package Current\PATCHTMP1000\581\Templates\\0000, not selected for selective pull
      McAfeeHttp 2010-11-23 19:52:51.0 INFO Skipping package Current\PATCHTMP2000\285\Templates\\0000, not selected for selective pull
      McAfeeHttp 2010-11-23 19:52:51.007 INFO Skipping package Current\AUENGINEMETA\1053\BMContent\\0000, not selected for selective pull
      McAfeeHttp 2010-11-23 19:52:51.01 INFO Skipping package Current\Findings\1028\FNDContent\\0000, not selected for selective pull

       

      ===========================================PULL Task Configuration================================================================== =======

       

      Name:  REP-PULL-1: Update Master Repository McAfeeHTTP (Repository Pull) 
      Notes:  Changed to pull at 1715Hrs, 1815Hrs and 1915Hrs Pull via asia-proxy 16 Feb 2010 - Updated packages to pull 
      Task owner:  Donathon Ong (****1) 
      Schedule status:  Enabled 
      Schedule:  Start date:  5/22/09 
      End date:  No end date 
      Time frame:  Daily
      at 5:15 PM
      at 6:15 PM
      at 7:15 PM

      Next run time:  11/24/10 5:15 PM
      11/24/10 6:15 PM
      11/24/10 7:15 PM


      Actions:  1.  Repository Pull 
      Source site:  McAfeeHttp
      Branch:  Current
      Support NetShield for NetWare : False
      Move existing package to Previous branch : True
      Select Packages : 9: BOCVSE__1000,VSCANDAT1000,VSCANENG1000,EXTRADAT1000,SUPERDAT1000,SUPPCLNT1000,VIRUSCAN8600,VIRUSCAN8700,S UPPMVTCT1000    

      ================================================================================ =============================================================

        • 1. Re: ePO 4.0 HTTP Pull not updating to latest DAT
          Attila Polinger

          Hi,

           

          On the line under Automation - Server Tasks, where you see the pull task you should see several other properties like if it is enabled at all, when is the next time it should run etc. Do a sanity check on these, too, if the task did not run at the scheduled interval.

           

          Otherwise please wait until the pull task should run and monitor the server task log, how it is doing.If you see that the task runs but fails, post here the  Program Files\McAfee\ePolicy Orchestrator\DB\Logs\ePOaPsrv.log. If the task completes, check the master repository for the DAT version in Current and the Dashboard for the comparison of DATs in your ePO vs. at McAfee site. If that does not match, post the same file here.

           

          Please indicate the time the task ran to help us find the location easier...

           

          Attila

          • 2. Re: ePO 4.0 HTTP Pull not updating to latest DAT

            Hi Polinger,

             

            Thanks for the reply. Here is the result of last night's schedule PULL Task Log. Note that the time is GTM+0100.

             

            ========PULL Task Failed - Log in ePO Dashboard========

            McAfeeHttp 2010-11-24 19:53:02.413 INFO Skipping package Current\FSCANENG1000\5400.2003\Engine\\0000, not selected for selective pull
            McAfeeHttp 2010-11-24 19:53:02.42 INFO Skipping package Current\LMASECORE2000\2.2.0.9286\SpamEngine\\0000, not selected for selective pull
            McAfeeHttp 2010-11-24 19:53:02.423 INFO Skipping package Current\MASECORE2000\2.2.0.9286\SpamEngine\\0000, not selected for selective pull
            McAfeeHttp 2010-11-24 19:53:02.43 INFO Skipping package Current\ENCPTCNT6000\7.0.0.3429\DAT\\0000, not selected for selective pull
            McAfeeHttp 2010-11-24 19:53:02.437 INFO Skipping package Current\PATCHTMP1000\581\Templates\\0000, not selected for selective pull
            McAfeeHttp 2010-11-24 19:53:02.443 INFO Skipping package Current\PATCHTMP2000\285\Templates\\0000, not selected for selective pull
            McAfeeHttp 2010-11-24 19:53:02.45 INFO Skipping package Current\AUENGINEMETA\1053\BMContent\\0000, not selected for selective pull
            McAfeeHttp 2010-11-24 19:53:02.457 INFO Skipping package Current\Findings\1028\FNDContent\\0000, not selected for selective pull
            McAfeeHttp 2010-11-24 19:53:02.963 INFO Downloading package Current\VSCANDAT1000\6177.0000\DAT\0000
            McAfeeHttp 2010-11-24 20:08:16.517 ERROR Failed to download file Current\VSCANDAT1000\DAT\0000\61416142avv.gem from site update.nai.com:80, error code 2 ( The system cannot find the file specified. )
            ===============================================

             

            ===============DAT Version in Dashboard=============

            AntiSpyware Enterprise Module Install 8.5.0 163 Neutral Current Change Branch | Delete
            AntiSpyware Enterprise Module Install 8.7.0 129 Neutral Current Change Branch | Delete
            Buffer Overflow DAT for VirusScan Enterprise DAT 499  Neutral Previous Change Branch | Delete
            Buffer Overflow DAT for VirusScan Enterprise DAT 516  Neutral Current Change Branch | Delete
            DAT DAT 6175.0000  Neutral Previous Change Branch | Delete
            DAT DAT 6176.0000  Neutral Current Change Branch | Delete
            Engine Engine 5400.1158 4778 Neutral Current Change Branch | Delete
            ePO Agent Key Updater Plugin 4.5.0  Neutral Current Change Branch | Delete
            ePO-MVT Install 1.0.4 0 English Current Change Branch | Delete
            ePO-MVT Content MVTContentUpdate 1.0.5.5 5 Neutral Current Change Branch | Delete
            Linux Engine Engine 5400.1158 4778 Neutral Current Change Branch | Delete
            Mac Engine Engine 5400.1158 4778 Neutral Current Change Branch | Delete
            McAfee Agent for Windows Install 4.0.0 1494 English Current Change Branch | Delete
            MER for ePO Service Pack 2.3.0 1095 Neutral Current Change Branch | Delete
            VirusScan Enterprise Hot Fix 8.7.0 3 Neutral Current Change Branch | Delete
            VirusScan Enterprise Language Pack 8.7.0  Neutral Current Change Branch | Delete
            VirusScan Enterprise Install 8.7.0 570 Neutral Current Change Branch | Delete
            VirusScan Enterprise Hot Fix 8.5.0 8 Neutral Current Change Branch | Delete
            VirusScan Enterprise Install 8.5.0 781 Neutral Current Change Branch | Delete
            VirusScan Enterprise Language Pack 8.5.0  Neutral Current Change Branch | Delete

            ======================================================

             

            ==============  Directory of C:\Program Files\McAfee\ePolicy Orchestrator\DB\Software\Current\VSCANDAT1000\DAT\0000\===========

             

             

              C:\Program Files\McAfee\ePolicy Orchestrator\DB\Software\Current\VSCANDAT1000\DAT\0000\
              =============================================================================== =======
              56485649.upd                          244 KB    1/07/2009 11:01:50 PM      a
              56495650.upd                          299 KB    1/07/2009 11:01:50 PM      a
              56505651.upd                          408 KB    1/07/2009 11:01:48 PM      a
              56515652.upd                          226 KB    1/07/2009 11:01:48 PM      a
              56525653.upd                          326 KB    1/07/2009 11:01:48 PM      a
              56535654.upd                          219 KB    1/07/2009 11:01:48 PM      a
              56545655.upd                          240 KB    1/07/2009 11:01:48 PM      a
              56555656.upd                          236 KB    1/07/2009 11:01:48 PM      a
              56565657.upd                          238 KB    1/07/2009 11:01:46 PM      a
              56575658.upd                          534 KB    1/07/2009 11:01:46 PM      a
              56585659.upd                          397 KB    1/07/2009 11:01:46 PM      a
              56595660.upd                          368 KB    1/07/2009 11:01:46 PM      a
              56605661.upd                          198 KB    1/07/2009 11:01:46 PM      a
              56615662.upd                          393 KB    1/07/2009 11:01:44 PM      a
              56625663.upd                          549 KB    1/07/2009 11:01:44 PM      a
              61416142avv.gem                        62 KB  24/11/2010 03:32:10 AM      a
              61426143avv.gem                        123 KB  24/11/2010 03:32:08 AM      a
              61436144avv.gem                        25 KB  24/11/2010 03:32:06 AM      a
              61446145avv.gem                        128 KB  24/11/2010 03:32:06 AM      a
              61456146avv.gem                        262 KB  24/11/2010 03:32:04 AM      a
              61466147avv.gem                        253 KB  24/11/2010 03:32:02 AM      a
              61476148avv.gem                        119 KB  24/11/2010 03:32:00 AM      a
              61486149avv.gem                        192 KB  24/11/2010 03:31:58 AM      a
              61496150avv.gem                        259 KB  24/11/2010 03:31:56 AM      a
              61506151avv.gem                        20 KB  24/11/2010 03:31:54 AM      a
              61516152avv.gem                        244 KB  24/11/2010 03:31:52 AM      a
              61526153avv.gem                        70 KB  24/11/2010 03:31:50 AM      a
              61536154avv.gem                        102 KB  24/11/2010 03:31:50 AM      a
              61546155avv.gem                        136 KB  24/11/2010 03:31:48 AM      a
              61556156avv.gem                        73 KB  24/11/2010 03:31:46 AM      a
              61566157avv.gem                        81 KB  24/11/2010 03:31:46 AM      a
              61576158avv.gem                          6 KB  24/11/2010 03:31:44 AM      a
              61586159avv.gem                        238 KB  24/11/2010 03:31:44 AM      a
              61596160avv.gem                        79 KB  24/11/2010 03:31:42 AM      a
              61606161avv.gem                        104 KB  24/11/2010 03:31:42 AM      a
              61616162avv.gem                        369 KB  24/11/2010 03:31:40 AM      a
              61626163avv.gem                        206 KB  24/11/2010 03:31:36 AM      a
              61636164avv.gem                        171 KB  24/11/2010 03:31:34 AM      a
              61646165avv.gem                        33 KB  24/11/2010 03:31:34 AM      a
              61656166avv.gem                        88 KB  24/11/2010 03:31:32 AM      a
              61666167avv.gem                        104 KB  24/11/2010 03:31:32 AM      a
              61676168avv.gem                        173 KB  24/11/2010 03:31:30 AM      a
              61686169avv.gem                        465 KB  24/11/2010 03:31:28 AM      a
              61696170avv.gem                        439 KB  24/11/2010 03:31:26 AM      a
              61706171avv.gem                        385 KB  24/11/2010 03:31:22 AM      a
              61716172avv.gem                        54 KB  24/11/2010 03:31:18 AM      a
              61726173avv.gem                        197 KB  24/11/2010 03:31:18 AM      a
              61736174avv.gem                        241 KB  24/11/2010 03:31:16 AM      a
              61746175avv.gem                        224 KB  24/11/2010 03:31:14 AM      a
              61756176avv.gem                        265 KB  24/11/2010 03:31:12 AM      a
              avvdat.ini                              3 KB  24/11/2010 03:32:10 AM      a
              avvdat-6176.zip                      76239 KB  24/11/2010 03:31:08 AM      a
              ceu.ini                                  1 KB  24/11/2010 03:32:10 AM      a
              dat-5663.zip                        61840 KB    1/07/2009 11:01:18 PM      a
              datinstall.mcs                          48 KB    1/07/2009 11:00:48 PM      a
              delta.ini                                1 KB    1/07/2009 11:01:52 PM      a
              extradat.mcs                            20 KB  24/11/2010 03:32:16 AM      a
              gdeltaavv.ini                            2 KB  24/11/2010 03:32:10 AM      a
              PkgCatalog.z                            3 KB  24/11/2010 03:19:56 AM      a
              Replica.log                              4 KB  24/11/2010 03:32:28 AM      a
              scmdat.pdb                            456 KB  24/11/2010 03:32:14 AM      a
              update.ini                              1 KB    1/07/2009 11:01:52 PM      a
              V2datdet.mcs                            82 KB  24/11/2010 03:32:16 AM      a
              V2datinstall.mcs                        85 KB  24/11/2010 03:19:58 AM      a


              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
              Total 0 folder(s); 64 file(s)

              Total files size: 150 MB; 149681 KB; 153273043 Bytes

              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

             

             

            Message was edited by: donathon on 11/24/10 7:10:48 PM CST

             

             

            Message was edited by: donathon on 11/24/10 7:11:53 PM CST
            • 3. Re: ePO 4.0 HTTP Pull not updating to latest DAT
              Attila Polinger

              Hi,

               

              I think the ePOaPsrv.log that you have attached contains no data for the pull task, only for the replication task; I could not find any entry on or around the times when the pull task should have been run (5:15 pm, etc.).

              Would you be so kind as to wait until the pull task runs by itself and then grab the ePOaPsrv.log and attach here?

               

              Thanks.

               

              Attila

              • 4. Re: ePO 4.0 HTTP Pull not updating to latest DAT

                Can I do a run now to the scheduled task and attach the log to you?

                • 5. Re: ePO 4.0 HTTP Pull not updating to latest DAT
                  Attila Polinger

                  Yes, sure, thanks.

                   

                  Before that, please set Loglevel to 8 on ePO server, as described in here (also wait a few minutes afterwards, before you'd run the task, so this setting takes effect)

                  https://kc.mcafee.com/corporate/index?page=content&id=KB56207&actp=search&viewlo cale=en_US&searchid=1290759443596

                   

                  Attila

                  • 6. Re: ePO 4.0 HTTP Pull not updating to latest DAT

                    Hi,

                     

                    I am stucked at step 2, it says "Error writing content".

                    • 7. Re: ePO 4.0 HTTP Pull not updating to latest DAT
                      Attila Polinger

                      I think the article might be incomplete here regarding what needs to be done on basic level. Essentially, before the regkey would be written, the Virusscan Access Protection must be disabled *

                      This can be done through the VirusScan console by right clicking the Access Protection module and selecting "Disable".

                       

                      After that you should be able to write the regkey.

                       

                      Attila

                       

                      * (seemingly the article tries to achieve this by making the reader stop McShield which action rightly requires step one, but missing step 1,5 "Stop McShield service").

                      • 8. Re: ePO 4.0 HTTP Pull not updating to latest DAT

                        Hi,

                         

                        I have tried unsucessfully to find out what is the exact cause for this. The HTTP Pull task works for a while and fails. When I run the task manually, it works like a charm for a few days and than it fails again. I am really wondering if this is the fault of McAfee. From the logs, I can see that it is trying to download a defination file that is from the previous directory. At the time of the log below, the current DAT on http://update.nai.com in the "Current" directory is 6190. Therefore the ePO should download avvdat-6190.zip instead of 6189.zip. I ran a manual update and it worked!! But 2000 of my clients are updating remotely via that single Master Repository which is not desirable. I have 42 sites and running a manual incremental push task takes hours to complete. by the time it completes, the latest update would be 6191!!

                         

                        ePO Server Summery Log: 2010-12-07 19:59:56.637 Failed to download file Current\VSCANDAT1000\DAT\0000\avvdat-6189.zip from site update.nai.com:80, error code 2

                         

                        ePO Server Detail Log:

                        20101207195954726        I              #4016    SiteMgr                CheckInMirrorPackage: Downloading file avvdat-6189.zip from site McAfeeHttp::Current\VSCANDAT1000\DAT\0000

                        20101207195954726        I              #4016    SIM_InetMgr    Downloading file avvdat-6189.zip from session 1, LocalDir=C:\WINDOWS\TEMP\nai3FE.tmp\00000003, RemoteDir=Current\VSCANDAT1000\DAT\0000

                        20101207195954726        I              #4016    naInet  Open URL: http://update.nai.com:80/Products/CommonUpdater2/Current/VSCANDAT1000/DAT/0000/a vvdat-6189.zip

                        20101207195954726        I              #4016    naInet  Trying to download using Microsoft WinInet library

                        20101207195954741        I              #4016    naInet  Conneting to Proxy Server proxy-asia.clariant.com:8080 using INTERNET_OPEN_TYPE_PROXY

                        20101207195954757        I              #4016    naInet  No resume download needed, calling InternetOpenUrl

                        20101207195955866        X            #4016    naInet  HTTP Server returned FileNotFound (404) for URL http://update.nai.com:80/Products/CommonUpdater2/Current/VSCANDAT1000/DAT/0000/a vvdat-6189.zip

                        20101207195955866        I              #4016    SIM_InetMgr    Download file avvdat-6189.zip not found on the remote dir Current\VSCANDAT1000\DAT\0000 in session 1

                        • 9. Re: ePO 4.0 HTTP Pull not updating to latest DAT
                          Attila Polinger

                          Hello,

                           

                          at this time I can only give the advice that you should try rebuilding your master repository based on article https://kc.mcafee.com/corporate/index?page=content&id=KB53736&actp=search&viewlo cale=en_US&searchid=1291899824473. This might help eliminate any inconsitencies here you might have resulting in the error you are seeing.

                           

                          Also, look into the pull task and make sure you have it set to selective, so that nothing comes down that you do not want, check the branch setting, too.

                           

                          With the freshly rebuild MR, you can again try running the pull task at different intervals (and more often than 3 times) checking the Avert status on the main dashboard whether you are protected or not one time a day (in the morning for example).

                           

                          A slower pull method would be to set the task to FTP site if all else fails with other preferences like above.

                           

                          Attila