8 Replies Latest reply on Jan 26, 2012 3:34 AM by jmcleish

    Virusscan for Mac 9.1 (Security for Mac 1.1) support for Lion 10.7.2 Security for Mac 9.1 (1.1) support for Lion 10.7.2

      Hello!

       

      I've been testing some Lion machines with the latest version of Security 1.1 build 1309 with agent 4.6.0.1694.

       

      The installation of the agent works fine. The computer reports back to the EPO. But it wont deploy Virusscan 9.1 for Mac.

       

      I have downloade the Virusscan 9.1 zip file and checked in the package and extention in the repository. I also have checked in the hotfix.

       

      I'll get the following error, one of many but I think this error is what it is all about.

       

      2012-01-24 11:50:32 [126]  [Management]  [I] None of the policies exists for the software Id VSCANMAC9100

       

      Best regards

      Freddie

        • 1. Re: Virusscan for Mac 9.1 (Security for Mac 1.1) support for Lion 10.7.2 Security for Mac 9.1 (1.1) support for Lion 10.7.2
          jmcleish

          Hi Freddie,

           

          Is the deployment task actually kicking off to install Vscan?

          Are these clean machines with no AV on them or pervious agent as there's a specific set of instructions on how to upgrade the clients that already have a previous av or agent version.

           

          Also, What version of ePO are you running?

          What hotfix?

           

          edit: Also, what build of Lion are you running?

           

          Can you attach the log file at all?

           

          Thanks

           

          Message was edited by: jmcleish on 25/01/12 03:55:09 CST
          • 2. Re: Virusscan for Mac 9.1 (Security for Mac 1.1) support for Lion 10.7.2 Security for Mac 9.1 (1.1) support for Lion 10.7.2

            Hi,

             

            Thanks for your fast answer!

             

            Is the deployment task actually kicking off to install Vscan? I have read the logs correct the answer is no.

             

            Any erlier AV products? No and it is a completly new install of OS X 10.7.2

             

            Also, What version of ePO are you running? 4.6.0 build 1029

            What hotfix? No hotfix

             

            What build of Lion are you running? 10.7.2 /11C74)

             

            Thanks again!

            /Freddie

             

            Message was edited by: frecar on 1/25/12 4:13:41 AM CST
            • 3. Re: Virusscan for Mac 9.1 (Security for Mac 1.1) support for Lion 10.7.2 Security for Mac 9.1 (1.1) support for Lion 10.7.2
              jmcleish

              Can you modify the deployment task slightly (i.e. set to run immediately, and stop the task running for more than 6 hours for example) and do an agent wakeup call.

               

              What is it showing in the client log when you do a wakeup- can you post it please?

               

              Sorry- you mentioned you'd checked in a hotfix- what hotfix are you referring to?

              • 4. Re: Virusscan for Mac 9.1 (Security for Mac 1.1) support for Lion 10.7.2 Security for Mac 9.1 (1.1) support for Lion 10.7.2

                Hotfix 688476 for Virusscan 9.1.

                 

                2012-01-25 12:48:02 [92]  [Management]  [I] Enforcing policies

                2012-01-25 12:48:02 [92]  [Management]  [I] Legacy Policies exists for the software Id EPOAGENT3700MACX

                2012-01-25 12:48:02 [92]    [Plugin]  [I] Going to Enforce Policy

                2012-01-25 12:48:02 [92]     [events] [I] Creating event interface object

                2012-01-25 12:48:02 [92]    [Plugin]  [I] Going to Check Software Exists

                2012-01-25 12:48:02 [92]     [events] [I] deleting event interface object

                2012-01-25 12:48:02 [92]     [Agent]  [I] Enforcing agent policies

                2012-01-25 12:48:02 [92]  [Management]  [I] Enforcing management subsystem policies

                2012-01-25 12:48:02 [92]  [Management]  [I] Properties collection is marked for Maximum

                2012-01-25 12:48:02 [92]    [updsubs] [I] Enforcing updater subsystem policies

                2012-01-25 12:48:02 [92] [Management] [I] Retrieved current event policies successfully

                2012-01-25 12:48:02 [92] [Management] [I] Event policies unchanged

                2012-01-25 12:48:02 [92] [Management] [I] Finished event policy update

                2012-01-25 12:48:02 [92]     [Agent]  [I] Next Policy Enforcement will be in : 300 seconds

                2012-01-25 12:52:15 [92]     [Agent]  [I] Forward immediate events request received

                2012-01-25 12:52:44 [92]    [Pckproc] [I] after wait timeInterval=2147483647

                2012-01-25 12:52:44 [92]    [Pckproc] [I] start processPackage timeInterval=2147483647

                2012-01-25 12:52:44 [92]     [Agent]  [I] Received agent ping from ePO server

                2012-01-25 12:52:44 [92]    [Pckproc] [I] end processPackage timeInterval=2147483647

                2012-01-25 12:52:44 [92]    [Pckproc] [I] before wait timeInterval=2147483647

                2012-01-25 12:52:45 [92]     [Agent]  [I] Verifying agent GUID

                2012-01-25 12:52:45 [92]     [Agent]  [I] Agent will connect to Server in : 0 seconds

                2012-01-25 12:52:45 [92]        [Asc] [I] m_lastASCITime = 1327492365

                2012-01-25 12:52:45 [92]     [Agent]  [I] Agent started performing ASCI

                2012-01-25 12:52:45 [92]  [Management]  [I] Collecting properties

                2012-01-25 12:52:45 [92]    [Plugin]  [I] Going to Collect Properties

                2012-01-25 12:52:45 [92]     [events] [I] Creating event interface object

                2012-01-25 12:52:45 [92]    [Plugin]  [I] Going to Check Software Exists

                2012-01-25 12:52:45 [92]  [Cryptshim] [I] Successfully freed key data

                2012-01-25 12:52:45 [92]    [agProps] [I] Setting the properties as :/Library/McAfee/cma : 4.6.0.1694 : 4.6.0.1694 : 5 : 60 : {90EBE19B-C945-E111-854A-000000000000} : 8081 : 1 :

                2012-01-25 12:52:45 [92]     [events] [I] deleting event interface object

                2012-01-25 12:52:45 [92]     [Agent]  [I] Forward all events request received

                2012-01-25 12:52:45 [92]    [Pckproc] [I] after wait timeInterval=2147483647

                2012-01-25 12:52:45 [92]    [Pckproc] [I] start processPackage timeInterval=2147483647

                2012-01-25 12:52:45 [92]  [Management]  [I] Requested for the Full Props by the Agent

                2012-01-25 12:52:45 [92]     [Agent]  [I] Verifying agent GUID

                2012-01-25 12:52:45 [92]     [Agent]  [I] Agent will connect to Server in : 1216 seconds

                2012-01-25 12:52:45 [92]    [SpiPkgr] [I] Using sequence number 102

                2012-01-25 12:52:45 [92]     [Agent]  [I] Agent server communication session started

                2012-01-25 12:52:45 [92]     [Agent]  [I] Package type is propssend package

                2012-01-25 12:52:45 [92]     [Agent]  [I] Agent is connecting to ePO server

                2012-01-25 12:53:02 [92]  [Management]  [I] Enforcing policies

                2012-01-25 12:53:02 [92]  [Management]  [I] Legacy Policies exists for the software Id EPOAGENT3700MACX

                2012-01-25 12:53:02 [92]    [Plugin]  [I] Going to Enforce Policy

                2012-01-25 12:53:02 [92]     [events] [I] Creating event interface object

                2012-01-25 12:53:02 [92]    [Plugin]  [I] Going to Check Software Exists

                2012-01-25 12:53:02 [92]     [events] [I] deleting event interface object

                2012-01-25 12:53:02 [92]     [Agent]  [I] Enforcing agent policies

                2012-01-25 12:53:02 [92]  [Management]  [I] Enforcing management subsystem policies

                2012-01-25 12:53:02 [92]  [Management]  [I] Properties collection is marked for Maximum

                2012-01-25 12:53:02 [92]    [updsubs] [I] Enforcing updater subsystem policies

                2012-01-25 12:53:02 [92] [Management] [I] Retrieved current event policies successfully

                2012-01-25 12:53:02 [92] [Management] [I] Event policies unchanged

                2012-01-25 12:53:02 [92] [Management] [I] Finished event policy update

                2012-01-25 12:53:02 [92]     [Agent]  [I] Next Policy Enforcement will be in : 300 seconds

                2012-01-25 12:54:00 [92]     [imsite] [I] Found site name=McAfeeFtp

                2012-01-25 12:54:00 [92]     [imsite] [I] Found site name=ePO_hidden-EPO01

                2012-01-25 12:54:00 [92]     [imsite] [I] Found site name=ePO_hidden-AH01

                2012-01-25 12:54:00 [92]    [persite] [I] Starting sorting of repositories using ping time

                2012-01-25 12:54:00 [92]     [naInet] [I] HTTP Session initialized

                2012-01-25 12:54:00 [92]     [naInet] [I] HTTP Session initialized

                2012-01-25 12:54:00 [92]     [imsite] [I] Pinging SPIPE site = ePO_hidden-AH01

                2012-01-25 12:54:00 [92]     [imsite] [I] IP address = 112.62.95.58

                2012-01-25 12:54:00 [92]     [imsite] [I] Pinging SPIPE site = ePO_hidden-EPO01

                2012-01-25 12:54:00 [92]       [ping] [I] ICMP::Ping - Pinging 112.62.95.58 with a timeout of 30 seconds

                2012-01-25 12:54:00 [92]     [imsite] [I] IP address = 192.168.0.173

                2012-01-25 12:54:00 [92]       [ping] [I] ICMP::Ping - Pinging 192.168.0.173 with a timeout of 30 seconds

                2012-01-25 12:54:00 [92]       [ping] [I] ICMP::Ping - Avg ping time is 0

                2012-01-25 12:54:00 [92]     [imsite] [I] Delay = 0 (in millisecs)

                2012-01-25 12:55:30 [92]     [imsite] [I] Ping using IP address failed.

                2012-01-25 12:55:30 [92]     [imsite] [I] Site name = hidden-EPO01.hidden.LOCAL

                2012-01-25 12:55:30 [92]       [ping] [I] ICMP::Ping - Pinging hidden-EPO01.hidden.LOCAL with a timeout of 30 seconds

                2012-01-25 12:55:35 [92]     [imsite] [I] Ping using site name failed.

                2012-01-25 12:55:35 [92]     [imsite] [I] Computer name = hidden-EPO01

                2012-01-25 12:55:35 [92]       [ping] [I] ICMP::Ping - Pinging hidden-EPO01 with a timeout of 30 seconds

                2012-01-25 12:55:40 [92]     [imsite] [I] Ping using computer name failed.

                2012-01-25 12:55:40 [92]     [imsite] [I] Connecting to site = ePO_hidden-EPO01

                2012-01-25 12:56:56 [92]     [naInet] [I] Unable to connect to 192.168.0.173 on port 443.

                2012-01-25 12:57:06 [92]     [naInet] [I] Unable to connect to hidden-EPO01.hidden.LOCAL on port 443.

                2012-01-25 12:57:15 [92]     [Agent]  [I] Forward immediate events request received

                2012-01-25 12:57:16 [92]     [naInet] [I] Unable to connect to hidden-EPO01 on port 443.

                2012-01-25 12:57:16 [92]     [imsite] [I] Failed to connect to site ePO_hidden-EPO01

                2012-01-25 12:57:16 [92]     [imsite] [I] Delay = 65535 (in millisecs)

                2012-01-25 12:57:16 [92]    [persite] [I] Sorting of repositories finished successfully. Total number of repositories sorted:3

                2012-01-25 12:57:16 [92]     [naInet] [I] HTTP Session closed

                2012-01-25 12:57:16 [92]     [naInet] [I] HTTP Session closed

                2012-01-25 12:57:16 [92]    [imutils] [I] Trying with site: 192.168.0.173:80

                2012-01-25 12:57:16 [92]     [naInet] [I] HTTP Session initialized

                2012-01-25 12:57:16 [92]     [imsite] [I]           Upload from: /Library/McAfee/cma/scratch/Unpack/pkgWedJan251152452012_1436132830.spkg

                2012-01-25 12:57:16 [92]     [imsite] [I]           Upload response target: /Library/McAfee/cma/scratch/Unpack/pkgWedJan251152452012_1515765177.spkg

                2012-01-25 12:58:02 [92]  [Management]  [I] Enforcing policies

                2012-01-25 12:58:02 [92]  [Management]  [I] Legacy Policies exists for the software Id EPOAGENT3700MACX

                2012-01-25 12:58:02 [92]    [Plugin]  [I] Going to Enforce Policy

                2012-01-25 12:58:02 [92]     [events] [I] Creating event interface object

                2012-01-25 12:58:02 [92]    [Plugin]  [I] Going to Check Software Exists

                2012-01-25 12:58:02 [92]     [events] [I] deleting event interface object

                2012-01-25 12:58:02 [92]     [Agent]  [I] Enforcing agent policies

                2012-01-25 12:58:02 [92]  [Management]  [I] Enforcing management subsystem policies

                2012-01-25 12:58:02 [92]  [Management]  [I] Properties collection is marked for Maximum

                2012-01-25 12:58:02 [92]    [updsubs] [I] Enforcing updater subsystem policies

                2012-01-25 12:58:02 [92] [Management] [I] Retrieved current event policies successfully

                2012-01-25 12:58:02 [92] [Management] [I] Event policies unchanged

                2012-01-25 12:58:02 [92] [Management] [I] Finished event policy update

                2012-01-25 12:58:02 [92]     [Agent]  [I] Next Policy Enforcement will be in : 3

                • 5. Re: Virusscan for Mac 9.1 (Security for Mac 1.1) support for Lion 10.7.2 Security for Mac 9.1 (1.1) support for Lion 10.7.2
                  jmcleish

                  Doesn't look like its picking up the task.

                   

                  I would expect to see entries like this:

                  2012-01-25 10:36:22 [27260]     [Agent]  [I] New server policy was successfully merged

                  2012-01-25 10:36:22 [27260]     [Agent]  [I] Enforcing newly downloaded policies

                  ....

                  2012-01-25 10:36:31 [27260]  [Scheduler]  [N] Restarting task scheduler...

                  2012-01-25 10:36:34 [27260]  [Scheduler]  [I] Task [Install Mac AV 9.1] loaded successfully

                  2012-01-25 10:36:44 [27260]  [Scheduler]  [N] Invoking task [Install Mac AV 9.1]...

                   

                  Create a new task just for that machine and then do a wakeup and see what happens.

                   

                  I don't use 4.6 yet myself, but did notice this KB article.

                  maybe check the file and see:

                   

                  Macs running Security for Mac 1.1 become unmanageable

                   

                                                            

                  Corporate KnowledgeBase ID:  KB72321
                  Last Modified:  July 01, 2011

                   

                   

                  Environment

                  McAfee Security for Mac 1.1
                  Mac OS X

                   

                   

                  Problem

                  When McAfee Security for Mac 1.1 is managed via McAfee ePolicy Orchestrator 4.6, the Mac may become unmanageable.

                   

                  NOTE: The Mac will become unmanageable only in scenarios where it cannot contact a Domain controller. If the Mac can resolve the Domain name, it will be able to connect to the ePO server and manageability is retained.

                   

                   

                  Cause

                  The following fields are missing from the SiteList.xml file:

                  • SecurePort
                  • ServerName
                  • ServerIP
                  • Version
                  • LocalVersion

                  McAfee Agent cannot interpret SiteList.xml without these fields and so the Mac becomes unmanageable.

                   

                  Solution

                  McAfee is aware of this issue.

                   

                  This issue is being evaluated for consideration in a future release or patched version of the product. If this issue significantly impacts your business operations, contact McAfee Technical Support and quote this article number to help us assess the need for a Product Enhancement Request (PER).

                   

                  This article will be updated as newer information becomes available.

                   

                  HTH

                  • 6. Re: Virusscan for Mac 9.1 (Security for Mac 1.1) support for Lion 10.7.2 Security for Mac 9.1 (1.1) support for Lion 10.7.2

                    Edit: I undertood you wrong. Now I understand.

                     

                    Thanks for all the help!!!

                     

                    I will have to talk to McAfee about this. This is a really big deal for us.

                     

                    Best regards

                    /Freddie

                     

                    Message was edited by: frecar on 1/25/12 7:34:18 AM CST
                    • 7. Re: Virusscan for Mac 9.1 (Security for Mac 1.1) support for Lion 10.7.2 Security for Mac 9.1 (1.1) support for Lion 10.7.2

                      Hi,

                       

                      I have now solved this issue. The extention is the problem.

                       

                      This is what I did to solve it:

                       

                      1. I have checked in McAfee VirusScan for Mac v9.1 package and extentions.

                      2. Assignd a pollicy and so on...

                      3. Deployment of Virusscan won't work

                      4. I check in the extention for McAfee Endpoint Protection for Mac 1.1, the one with the firewall included. New version of the extention is 9.1.0.3031, the old one were 9.1.0.3030. If you just look att the version number of the policy it must be a really small change.

                      5. Now everything work!

                       

                      Best regards

                      Freddie

                       

                      Message was edited by: frecar on 1/25/12 8:23:06 AM CST