6 Replies Latest reply on Mar 8, 2011 3:15 AM by rackroyd

    Agents deployed but unable to 'wake' them

      We are in the midst of rolling out VirusScan Enterprise (8.5) to our clients and servers.

       

      For some reason though, we have a small number of clients that have the agent installed but we cannot 'wake' the agent. 

       

      The client is PING-able from a command prompt on the server that has the ePO software installed, but when we try to PING it from within the ePO console, we get an error message indicating that the device is unreachable.

       

      The server log details give an error reading:  'error while reading TCP/IP resonse from remote system, possible firewall or agent policy blocking agent to server HTTP response.'

       

      It then attempts to wake up using NetBIOS and the IP address also and all return the same error message before the wakeup agent fails and the task expires.

       

      My old colleague who built the server and who's no longer working here informs me that once the agent is installed it should be able to pull the VirusScan Enterprise 8.5 software from the server and install them on the ePO client machines but that doesn't seem to be happening and it seems to be at odds with what I have read in McAfee's own documentation (that the software needs to be checked-in, which it appears to be, and then a task needs to be created for product deployment, etc.).

       

      If anyone can help, it'd be appreciated.

        • 1. Agents deployed but unable to 'wake' them
          alexander_h

          Hi,

           

          What about if you try to to initiate comunication from the agent console.

          You could install RSD(he will detect all systems and then you should be able to push agents.

          But first try to restart Epo services.

          • 2. Agents deployed but unable to 'wake' them

            thank you for your reply.

             

            Unfortunately, I'm not sure I follow (I'm sort of a novice with ePO).  There is a McAfee directory on the computers, but I don't know what I need to do to initiate communication from the agent console.  Do I need to run one of the apps located in the McAfee Common Framework directory?  If you could let me know which one, it'd be appreciated.

            • 3. Agents deployed but unable to 'wake' them
              rackroyd

              Agent wakeup uses IP port 8081 by default, but can be user-configured. Check the port setting in the ePO console.

              Normal reason for wake-up failure is because the specific port is blocked somewhere between agent and server.

               

              Note this does not affect normal (scheduled) agent communication, which uses IP port 80 (or 443) by default.

              If that's not working either you have something else going on.

               

              On the local machine, find and run cmdagent.exe /s - this should pop open the local agent monitor application.

              From there you can use the 'Collect and Send Props' button to initial a connection to the ePO server.

              If that generates errors it should be pretty clear in red on the agent monitor view.

               

              The agent monitor view is a summary of the Agent_<machinename>.log file.

              The log file is a more permanent record of agent activity and contains more detail.

               

              Rgds,

               

              Rob.

              1 of 1 people found this helpful
              • 4. Agents deployed but unable to 'wake' them

                Thank you for your assistance.  It looks like the agent communciation is OK (see communications details below from the cmdagent.exe /s command).

                 

                One thing I'm puzzled by is that supposedly we own 101 licenses for VirusScan.  I'd like to deploy the remaining licenses to our servers.  However, they don't show up in our master repository.  The Repository shows only the VirusScan language pack as being available, along with McAfee agents for Linux, Macs and Windows, virus definition files (which are in fact being deployed to clients that actually have the VirusScan Enterprise software installed on them), Rogue System Sensor,  & MER for ePO.

                 

                Where can I find out if we have more licenses/'products' (VirusScan Enterprise, in particular) that we can deploy?

                 

                the job I initiated below simply deploys an agent (which is actually already on the machine anyway, so it's not very useful).

                 

                sorry for so many questions.  I'm still trying to figure out how this all works.

                 

                 

                Agent Subsystem          3/8/2011          10:03:11 AM          Info          Agent communication session closed

                Agent Subsystem          3/8/2011          10:03:11 AM          Info          No package received from ePO Server

                Scheduler          3/8/2011          10:02:58 AM          Info          Scheduler: Task [TEST VS Deployment to Server] is finished

                Scheduler          3/8/2011          10:02:58 AM          Info          The task TEST VS Deployment to Server is successful

                Updater          3/8/2011          10:02:58 AM          Info          Update Finished

                Updater          3/8/2011          10:02:57 AM          Info          Loading update configuration from: catalog.xml

                Updater          3/8/2011          10:02:57 AM          Info          Extracting catalog.z.

                Updater          3/8/2011          10:02:57 AM          Info          Verifying catalog.z.

                Updater          3/8/2011          10:02:57 AM          Info          Initializing update...

                Updater          3/8/2011          10:02:56 AM          Info          Checking update packages from repository ePO_SHIMA0004.

                Agent Subsystem          3/8/2011          10:02:49 AM          Info          Agent is connecting to ePO server

                Agent Subsystem          3/8/2011          10:02:49 AM          Info          Agent is sending INC PROPS package to ePO server

                Agent Subsystem          3/8/2011          10:02:49 AM          Info          Agent communication session started

                Agent Subsystem          3/8/2011          10:02:49 AM          Info          Agent received REQUEST PROPS package from ePO server

                Agent Subsystem          3/8/2011          10:02:49 AM          Info          Agent communication session closed

                Agent Subsystem          3/8/2011          10:02:49 AM          Info          Package uploaded to ePO Server successfully

                Agent Subsystem          3/8/2011          10:02:28 AM          Info          Agent is connecting to ePO server

                Agent Subsystem          3/8/2011          10:02:28 AM          Info          Agent is sending PROPS VERSION package to ePO server

                Agent Subsystem          3/8/2011          10:02:28 AM          Info          Agent communication session started

                Management          3/8/2011          10:02:27 AM          Info          Collecting Properties

                Scheduler          3/8/2011          10:02:14 AM          Info          Scheduler: Invoking task [TEST VS Deployment to Server]...

                Agent Subsystem          3/8/2011          10:02:13 AM          Info          Next policy enforcement in 5 minutes

                Agent Subsystem          3/8/2011          10:02:13 AM          Info          Agent finished Enforcing policies

                Scheduler          3/8/2011          10:02:13 AM          Info          Added a new task TEST VS Deployment to Server to Scheduler's task list

                Management          3/8/2011          10:02:12 AM          Info          Enforcing Policies for McAfee Agent

                Management          3/8/2011          10:02:12 AM          Info          Enforcing Policies for EPOAGENT3000

                Management          3/8/2011          10:02:12 AM          Info          Enforcing Policies for EPOAGENT3000META

                Management          3/8/2011          10:02:12 AM          Info          Compiling policies

                Agent Subsystem          3/8/2011          10:02:12 AM          Info          Agent Started Enforcing policies

                Agent Subsystem          3/8/2011          10:02:12 AM          Info          Enforcing newly downloaded policies

                Agent Subsystem          3/8/2011          10:02:12 AM          Info          New server policy was successfully merged

                Agent Subsystem          3/8/2011          10:02:12 AM          Info          Agent received POLICY package from ePO server

                Agent Subsystem          3/8/2011          10:02:12 AM          Info          Agent communication session closed

                Agent Subsystem          3/8/2011          10:02:12 AM          Info          Package uploaded to ePO Server successfully

                Agent Subsystem          3/8/2011          10:02:06 AM          Info          Agent started performing ASCI

                Agent Monitor          3/8/2011          10:02:06 AM          Detail          Collecting Properties

                Agent Subsystem          3/8/2011          10:01:50 AM          Info          Agent is connecting to ePO server

                Agent Subsystem          3/8/2011          10:01:50 AM          Info          Agent is sending PROPS VERSION package to ePO server

                Agent Subsystem          3/8/2011          10:01:50 AM          Info          Agent communication session started

                Agent Subsystem          3/8/2011          10:01:50 AM          Info          Agent started performing ASCI

                Agent Subsystem          3/8/2011          10:01:30 AM          Info          Next policy enforcement in 5 minutes

                Agent Subsystem          3/8/2011          10:01:30 AM          Info          Agent finished Enforcing policies

                Management          3/8/2011          10:01:30 AM          Info          Enforcing Policies for McAfee Agent

                Management          3/8/2011          10:01:30 AM          Info          Enforcing Policies for EPOAGENT3000

                Management          3/8/2011          10:01:30 AM          Info          Enforcing Policies for EPOAGENT3000META

                Agent Subsystem          3/8/2011          10:01:30 AM          Info          Agent Started Enforcing policies

                Agent Monitor          3/8/2011          10:01:30 AM          Detail          Enforcing policies

                Agent Subsystem          3/8/2011          10:01:09 AM          Info          Agent is looking for events to upload

                Agent Monitor          3/8/2011          10:01:04 AM          Info          Agent service is running

                • 5. Agents deployed but unable to 'wake' them

                  I'm still getting the same error.  I just manually installed VirusScan 8.5 and it went OK.  I'm willing to not use ePO for installing VirusScan Enterprise on the servers for sheer time reasons (we only have about 15 servers and it's probably going to be faster for me to simply install them all individually rather than try to figure out why it's not showing up among the products available for deployment in ePO.)

                   

                  However, the server that I just installed and that needs an up-to-date definition file still doesn't update.  I'm still getting the same error as in my original post.  I just disabled the Windows Firewall on the server i'd like to have update it's DAT file and it can communicate with the ePO server FROM the client using the cmdagent /s as per above.

                   

                  Ugh... any help would be appreciated.

                  • 6. Agents deployed but unable to 'wake' them
                    rackroyd

                    It's not showing for deployment because you need to check it into the master repository.

                    VirusScan is not added by default to the Master repository on installation of ePO.

                     

                    You need to download the VirusScan installation package using your grant ID to access the downloads site, then check it into the master repository per the installation notes in the readme.htm file.

                     

                    As I mentioned before, an agent wakeup does not affect normal agent communications (as your log snippet confirms).

                     

                    Maybe it's best if you open a support call with McAfee so one of our Techs can walk you through the configuration ?

                    Otherwise please  take a look at the videos tutorials on the service portal website, they are a good place to jumpstart your ePO skills.

                     

                    https://mysupport.mcafee.com/Eservice/Default.aspx - Follow the 'Video Tutorials' link

                     

                    Rgds,

                     

                    Rob.