1 2 Previous Next 12 Replies Latest reply on Jun 29, 2011 1:18 AM by jpettersson

    McAfee Agent problems - updating DAT/Engine

      In our environment we have alot of computers and some of them have trouble to update the DAT/engine. Some of the agents are repoting that the client has never updated the VSE, some says it can't identify - leaving the DAT version empty and the last ones, the stranges once are the one that says DAT version N/A.

       

      Do someone recognize this problems? I have confirmed it has nothing to do with ports being closed etc.

       

      Im using ePO 4.0, Agent 4.0.0.1494, VSE 8.5.0.781.

       

      Thanks!

        • 1. Re: McAfee Agent problems - updating DAT/Engine

          EDIT: It's ePO 4.5 Build 851.

          • 2. Re: McAfee Agent problems - updating DAT/Engine
            tonyb99

            That sounds like a lot of problems.

             

            I assume that the agents were originally installed under an EPo 4.0 install and then its been upgraded to 4.5?

            Were there any issues with the upgrade like the certificate that might explain the loss of function?

             

            Have you tried sending out a new agent force installed over the other and then checking what happens.

             

            Do you have the two tasks to maintain duplicate GUIDs enabled in epo 4.5, I dont  think the agent version you are using supports GUID autoregeneration but the next one up does.

             

            What patch level of VSE 8.5 are you using

             

            Are you getting error in the parser logs on epo?

             

            If you set an update to run can you show us the log section from a client at this point when it fails

             

            Also programs such as deepfreeze, registry protectors or lack of space on clients could all cause this too

            • 3. Re: McAfee Agent problems - updating DAT/Engine

              Thanks for reply,

              It has always been a 4.5(what I know of), I just wrote wrong first. Its around 50 machines, based in different countries, which has theese problems, maybe round 0.5% of the computers.

               

              Yes I have forced new installation of the Agent, sometimes it works sometimes not.

               

              The VSE 8.5 is patch 8. I get no errors at all in the parser log file. I'll try to get the logs from a client up here.

              Could you please explain that "Two tasks to maintain duplicate GUIDs enables"?

               

              Some of the clients that have N/A as DAT get's updated when I performce force wakeup with force policy etc. But some of them don't.

               

              Thanks once more

              • 4. Re: McAfee Agent problems - updating DAT/Engine
                Attila Polinger

                Hi,

                 

                please allow me to butt in. tonyb99 suggests that your management system would be able to make one common problem (source of agent not getting tasks, policies from ePo server) go away: the one that is related to duplicate agent GUIDs on clients. However, this requires a certain client agent version. (As far as I know it is McAfee Agent 4.0 Patch 3 and 4.5 is capable of recognizing agentGUDI regeneration requests from ePO server.)

                (Taking your exact problems aside, this move has to be done regardless of any problems you have.

                 

                As far your exact problem is concerned, it would be good to diagnose what your issue is exactly rootored in. Could you please take a look at into McScript.log on one problem client? McScript.log is where your own computer have one, look for the same path on the remote client, too.

                updating problems do not necessarily come from duplicate GUID.

                 

                Attila

                • 5. Re: McAfee Agent problems - updating DAT/Engine

                  Here's one

                  McAfee Agent Activity Log; debug logs: FrameSvc fom a Agent that report in a blank(empty) DAT/engine:

                   

                  den 20 juni 2011 09:28:10

                  Info

                  Agent

                  Agent uploading 14 events to ePO Server

                  den 20 juni 2011 09:28:10

                  Info

                  Agent

                  Agent communication session started

                  den 20 juni 2011 09:28:10

                  Info

                  Agent

                  Agent is sending FULL PROPS package ePO server

                  den 20 juni 2011 09:28:10

                  Info

                  Agent

                  Agent is connecting to ePO server

                  den 20 juni 2011 09:28:11

                  Info

                  Agent

                  Package uploaded to ePO Server successfully

                  den 20 juni 2011 09:28:11

                  Info

                  Agent

                  Agent communication session closed

                  den 20 juni 2011 09:28:11

                  Info

                  Agent

                  Agent received POLICY package from ePO server

                  den 20 juni 2011 09:28:11

                  Info

                  Agent

                  New server policy was successfully merged

                  den 20 juni 2011 09:28:11

                  Info

                  Agent

                  Enforcing newly downloaded policies

                  den 20 juni 2011 09:28:11

                  Info

                  Agent

                  Agent Started Enforcing policies

                  den 20 juni 2011 09:28:11

                  Info

                  Management

                  Compiling policies

                  den 20 juni 2011 09:28:11

                  Info

                  Agent

                  Agent communication session started

                  den 20 juni 2011 09:28:11

                  Info

                  Agent

                  Agent is sending EVENT package to ePO server

                  den 20 juni 2011 09:28:11

                  Info

                  Agent

                  Agent is connecting to ePO server

                  den 20 juni 2011 09:28:11

                  Info

                  Agent

                  No package received from ePO Server

                  den 20 juni 2011 09:28:11

                  Info

                  Agent

                  Agent communication session closed

                  den 20 juni 2011 09:28:12

                  Info

                  Management

                  Enforcing Policies for EPOAGENT3000META

                  den 20 juni 2011 09:28:12

                  Info

                  Management

                  Enforcing Policies for EPOAGENT3000

                  den 20 juni 2011 09:28:12

                  Info

                  Management

                  Enforcing Policies for McAfee Agent

                  den 20 juni 2011 09:28:12

                  Info

                  Agent

                  Agent finished Enforcing policies

                  den 20 juni 2011 09:28:12

                  Info

                  Agent

                  Next policy enforcement in 60 minutes

                  den 20 juni 2011 09:31:30

                  Info

                  Updater

                  Backing up file(s) Engine DAT

                  den 20 juni 2011 09:31:33

                  Info

                  Updater

                  Pre-notifying for DAT update.

                  den 20 juni 2011 09:31:33

                  Info

                  Updater

                  Copying DAT.

                  den 20 juni 2011 09:31:34

                  Info

                  Updater

                  Update succeeded to version 6382.0000.

                  den 20 juni 2011 09:31:34

                  Info

                  Updater

                  Post-notifying for DAT update.

                  den 20 juni 2011 09:31:35

                  Info

                  Updater

                  Verifying VSE850Det.McS.

                  den 20 juni 2011 09:31:37

                  Info

                  Updater

                  Update Finished

                  • 6. Re: McAfee Agent problems - updating DAT/Engine

                    And heres the same log but fom a Agent that has DAT/Engine = N/A:

                     

                    den 20 juni 2011 09:25:50

                    Info

                    Updater

                    Downloading PkgCatalog.z.

                    den 20 juni 2011 09:25:50

                    Info

                    Updater

                    Verifying PkgCatalog.z.

                    den 20 juni 2011 09:25:50

                    Info

                    Updater

                    Extracting PkgCatalog.z.

                    den 20 juni 2011 09:25:50

                    Info

                    Updater

                    Loading update configuration from: PkgCatalog.xml

                    den 20 juni 2011 09:25:51

                    Info

                    Updater

                    Verifying V2engdet.mcs.

                    den 20 juni 2011 09:25:51

                    Info

                    Updater

                    Product(s) running the latest Engine.

                    den 20 juni 2011 09:25:51

                    Info

                    Updater

                    Downloading PkgCatalog.z.

                    den 20 juni 2011 09:25:51

                    Info

                    Updater

                    Verifying PkgCatalog.z.

                    den 20 juni 2011 09:25:51

                    Info

                    Updater

                    Extracting PkgCatalog.z.

                    den 20 juni 2011 09:25:51

                    Info

                    Updater

                    Loading update configuration from: PkgCatalog.xml

                    den 20 juni 2011 09:25:52

                    Info

                    Updater

                    Verifying V2datdet.mcs.

                    den 20 juni 2011 09:25:52

                    Info

                    Updater

                    Downloading PkgCatalog.z.

                    den 20 juni 2011 09:25:52

                    Info

                    Updater

                    Verifying PkgCatalog.z.

                    den 20 juni 2011 09:25:52

                    Info

                    Updater

                    Extracting PkgCatalog.z.

                    den 20 juni 2011 09:25:52

                    Info

                    Updater

                    Loading update configuration from: PkgCatalog.xml

                    den 20 juni 2011 09:25:53

                    Info

                    Updater

                    Starting DAT update.

                    den 20 juni 2011 09:25:53

                    Info

                    Updater

                    Downloading DAT.

                    den 20 juni 2011 09:25:53

                    Info

                    Updater

                    Downloading gdeltaavv.ini.

                    den 20 juni 2011 09:25:53

                    Info

                    Updater

                    Downloading 63796380avv.gem.

                    den 20 juni 2011 09:25:53

                    Info

                    Updater

                    Downloading 63806381avv.gem.

                    den 20 juni 2011 09:25:54

                    Info

                    Updater

                    Downloading 63816382avv.gem.

                    den 20 juni 2011 09:26:18

                    Info

                    Agent

                    Agent is looking for events to upload

                    den 20 juni 2011 09:26:18

                    Info

                    Agent

                    Agent uploading 1 events to ePO Server

                    den 20 juni 2011 09:26:18

                    Info

                    Agent

                    Agent communication session started

                    den 20 juni 2011 09:26:18

                    Info

                    Agent

                    Agent is sending EVENT package to ePO server

                    den 20 juni 2011 09:26:18

                    Info

                    Agent

                    Agent is connecting to ePO server

                    den 20 juni 2011 09:26:19

                    Info

                    Agent

                    No package received from ePO Server

                    den 20 juni 2011 09:26:19

                    Info

                    Agent

                    Agent communication session closed

                    den 20 juni 2011 09:31:18

                    Info

                    Agent

                    Agent is looking for events to upload

                    den 20 juni 2011 09:36:18

                    Info

                    Agent

                    Agent is looking for events to upload

                    den 20 juni 2011 09:41:18

                    Info

                    Agent

                    Agent is looking for events to upload

                    den 20 juni 2011 09:46:18

                    Info

                    Agent

                    Agent is looking for events to upload

                    den 20 juni 2011 09:51:18

                    Info

                    Agent

                    Agent is looking for events to upload

                    den 20 juni 2011 09:56:18

                    Info

                    Agent

                    Agent is looking for events to upload

                    den 20 juni 2011 10:01:18

                    Info

                    Agent

                    Agent is looking for events to upload

                    den 20 juni 2011 10:06:18

                    Info

                    Agent

                    Agent is looking for events to upload

                    den 20 juni 2011 10:11:18

                    Info

                    Agent

                    Agent is looking for events to upload

                    den 20 juni 2011 10:16:18

                    Info

                    Agent

                    Agent is looking for events to upload

                    den 20 juni 2011 10:21:18

                    Info

                    Agent

                    Agent is looking for events to upload

                    den 20 juni 2011 10:21:19

                    Info

                    Agent

                    Agent Started Enforcing policies

                    den 20 juni 2011 10:21:19

                    Info

                    Management

                    Enforcing Policies for VIRUSCAN8600

                    den 20 juni 2011 10:21:20

                    Info

                    Management

                    Enforcing Policies for EPOAGENT3000META

                    den 20 juni 2011 10:21:20

                    Info

                    Management

                    Enforcing Policies for EPOAGENT3000

                    den 20 juni 2011 10:21:20

                    Info

                    Management

                    Enforcing Policies for McAfee Agent

                    den 20 juni 2011 10:21:20

                    Info

                    Agent

                    Agent finished Enforcing policies

                    den 20 juni 2011 10:21:20

                    Info

                    Agent

                    Next policy enforcement in 60 minutes

                    den 20 juni 2011 10:26:18

                    Info

                    Agent

                    Agent is looking for events to upload

                    den 20 juni 2011 10:31:18

                    Info

                    Agent

                    Agent is looking for events to upload

                    den 20 juni 2011 10:36:18

                    Info

                    Agent

                    Agent is looking for events to upload

                    den 20 juni 2011 10:41:18

                    Info

                    Agent

                    Agent is looking for events to upload

                    den 20 juni 2011 10:46:18

                    Info

                    Agent

                    Agent is looking for events to upload

                    den 20 juni 2011 10:51:18

                    Info

                    Agent

                    Agent is looking for events to upload

                    den 20 juni 2011 10:56:18

                    Info

                    Agent

                    Agent is looking for events to upload

                    den 20 juni 2011 11:01:18

                    Info

                    Agent

                    Agent is looking for events to upload

                    den 20 juni 2011 11:06:18

                    Info

                    Agent

                    Agent is looking for events to upload

                    den 20 juni 2011 11:11:18

                    Info

                    Agent

                    Agent is looking for events to upload

                    den 20 juni 2011 11:16:18

                    Info

                    Agent

                    Agent is looking for events to upload

                    den 20 juni 2011 11:21:18

                    Info

                    Agent

                    Agent is looking for events to upload

                    den 20 juni 2011 11:21:20

                    Info

                    Agent

                    Agent Started Enforcing policies

                    den 20 juni 2011 11:21:20

                    Info

                    Management

                    Enforcing Policies for VIRUSCAN8600

                    den 20 juni 2011 11:21:20

                    Info

                    Management

                    Enforcing Policies for EPOAGENT3000META

                    den 20 juni 2011 11:21:20

                    Info

                    Management

                    Enforcing Policies for EPOAGENT3000

                    den 20 juni 2011 11:21:20

                    Info

                    Management

                    Enforcing Policies for McAfee Agent

                    • 7. Re: McAfee Agent problems - updating DAT/Engine

                      The main issue I want resolve is the ones that doesn't report any DAT at all. The other ones can be resolved by pushing out new agents etc.

                       

                      If someone have experiences with clients not reporting back any DAT's I woud greatly appreciate it!

                       

                      Thanks!

                      • 8. Re: McAfee Agent problems - updating DAT/Engine
                        Attila Polinger

                        Hi,

                         

                        Please attach Agent log from the client you want to diagnose. The log excerpt you provided here is lacking important sections.

                        for example in the second attachment it is not confirmed whether ePO server accepted the packet or rejected the agent. This does not show from this high level log.

                         

                        Nevertheless:

                        I recommend you change something in McAfee Agent policy, for example the ASCI frequency and initiate a contact with ePO server on the client. If the ASCI value then changes, then we can exclude rejection by ePO server of that client. Then we can go further.

                        However if the client is rejected, then we should go in a different direction (install new agent, and put the two server task in effect)

                         

                        Attila

                        • 9. Re: McAfee Agent problems - updating DAT/Engine
                          JoeBidgood

                          Have a look at KB 60515 - this may help.Sometimes the dat and engine version can't be retrieved from the engine as it's busy.

                           

                          HTH -

                           

                          Joe

                          1 2 Previous Next