1 2 Previous Next 16 Replies Latest reply on Dec 16, 2009 7:12 AM by lalanc01

    Event ID: 4354 using MA4.5, VSE8.7P2

      I am testing McAfee Agent 4.5 and VirusScan Enterprise 8.7, deployed from ePO 4.5. I have installed all patches for all 3 products, and the HotFix HF517265 for VSE 8.7 (although this event was showing up before I installed the HotFix also). I am seeing the following in Windows' Application Event Log when Windows starts:

      Source: EventSystem
      Category: (52)
      Event ID: 4354

      The COM+ Event System failed to fire the PostShell method on subscription {761212C6-8D27-402D-9E04-62DA54D4C40C}-{00000000-0000-0000-0000-000000000000}-{ 00000000-0000-0000-0000-000000000000}. The subscriber returned HRESULT 80004001.

      The number in the first set of brackets is different each time. It occurs about 3-5 minutes after the computer starts to boot. I happens on Windows XP 32-bit and Windows Server 2003 32-bit, but NOT on Windows Vista 64-bit Ultimate. I haven't tried it on Windows Vista 32-bit.

      Is anyone else seeing this?

      Jay
        • 1. RE: Event ID: 4354 using MA4.5, VSE8.7P2
          Having the same issue... events are appearing all over the place the last days. The events are not only generated after a reboot, but at random.

          The COM+ Event System failed to fire the PostShell method on subscription {07AD299B-3264-4AAE-89BE-4AC27A056A6D}-{00000000-0000-0000-0000-000000000000}-{ 00000000-0000-0000-0000-000000000000}. The subscriber returned HRESULT 8000400

          Any fix?
          • 2. RE: Event ID: 4354 using MA4.5, VSE8.7P2
            I am seeing the same events. I am seeing it on Windows 2003 32bit with VS 8.7 patch 2 and Agent 4.5. I started seeing them after rolling out Agent 4.5. Any fix?
            Dok
            • 3. Event ID: 4354 using MA4.5, VSE8.7P2
              I haven't seen any info on a cause or fix yet, but I haven't reported it to McAfee support because everything seems to be working and I'm too busy. I only get the events once or twice after booting a system.

              Jay
              • 4. RE: Event ID: 4354 using MA4.5, VSE8.7P2
                Quick update, it looks like the event occurs when a user logs in, not when Windows boots.

                Jay
                • 5. RE: Event ID: 4354 using MA4.5, VSE8.7P2
                  Got the same symptoms as above, have logged a service support with McAfee Corp.

                  Will revert if there is a fix...
                  • 6. RE: Event ID: 4354 using MA4.5, VSE8.7P2
                    Below email from : satheesh_sasidharan@mcafee.com
                    Response : from me


                    1. How many systems are managed by ePO? And how many of them are having this issue as of now?

                    200 systems
                    2 so far could be more, have not checked all

                    2. Is the VSE 87 patch2 updating successfully ?

                    Yes

                    3. Which are the OS versions affected by this issue?

                    W2k3 Ent SP2

                    4. Please check the event viewer, if there is an error related to this, please send us its screenshot.

                    As mentioned in this forum

                    5. Please check which product is actually causing this. Try removing VSE and the agent ( one by one on a test PC) and see if the error persists or not.

                    This is a production server I cant do this during office hrs

                    6. Uninstall any recently upgraded OS patch / service pack.

                    Why cant McAfee just provide a patch instead?

                    7. Run ProcessMonitor tool ( download link: http://live.sysinternals.com/Procmon.exe ) run on the affected system. Options - Enable Boot Logging. Reboot the system and Get the error.- Open ProcMon again and Save the log. Zip and send the logs to us for further investigation.

                    Will do
                    • 7. Re: RE: Event ID: 4354 using MA4.5, VSE8.7P2

                      Just wondering if you have heard anything back from McAfee on the issue as I'm are running into the same error.

                       

                       

                      Message was edited by: jcantin on 11/5/09 1:17 PM
                      • 8. Re: Event ID: 4354 using MA4.5, VSE8.7P2
                        secured2k

                        Hello,

                         

                        The HRESULT 8000 4001 (E_NOTIMPL) "Not Implemented" means the subscribed event is either not implemented or is unable to reach the subscriber due to insufficient permissions.

                        This could be because McAfee Behavior Blocking is stopping something from working for security reasons or a feature is being requested that McAfee or some other software is looking for from McAfee and the software is not allowing access (for security reasons).

                         

                        Besides these errors, have you noticed anything broken in functionality?

                        • 9. Re: RE: Event ID: 4354 using MA4.5, VSE8.7P2
                          wwarren

                          http://community.mcafee.com/message/22463#22463

                          This comment suggests it is related to the user-specific processes that get launched at logon.

                          It may be feasible to run tests against these processes in a production environment since they do not impact fundamental functionality of the products, just cosmetic things.

                           

                          McTray.exe, UdaterUI.exe, SHStat.exe

                           

                          The test would be to see if the events occur when these processes execute (or soon thereafter).

                          Therefore you could terminate them (requires Access Protection to be disabled), launch them manually... and watch for the event.

                           

                          The Procmon bootlog will also be interesting, because it will capture when the Event log gets written to - so you'd be curious to see what happened just prior. The trick might be knowing which write to the Event log was the event you're interested in (assuming there are many at the time).

                          1 2 Previous Next