6 Replies Latest reply on Nov 27, 2013 12:21 PM by JoeBidgood

    Agent not reporting products or updating properly

    cakeboss

      Weird issue only on one system. 

       

      1. After a fresh agent install, the MA seems to report properly for a couple ASCIs then will stop reporting that any products are installed, other than the MA (of which no product properties will be reported, such as Product Version). 

      2. If you perform an agent wakeup call, the last communication time will update, but none of the product properties will.
      3. If you reinstall the agent, it will report products correctly and update, but after a couple ASCIs will go back in to a state of not reporting properly.

       

      I have looked at KB72227, which seems to be an unrelated issue.  This system has no extra firewalls between it and the ePO server.  Also, despite the logs, the system is not low on memory or disk space.  Below is the agent log with the ePO IP redacted:

       

      2013-11-25 13:05:25.466 I #3316 LstnSvr CAsyncSocket::DoAccept for event: FD_ACCEPT

      2013-11-25 13:05:25.684 I #3352 LstnSvr 'POST' request received from Host: <ePO IP Address>:55872

      2013-11-25 13:05:25.700 I #3096 Agent Started processing a package..

      2013-11-25 13:05:25.700 i #3096 Agent Agent wakeup call received

      2013-11-25 13:05:25.700 i #3096 Agent Agent wakeup call for FULL PROPS received

      2013-11-25 13:05:25.700 i #3104 Agent Agent started performing ASCI

      2013-11-25 13:05:25.700 I #3104 Agent Network up ,Performing ASCI

      2013-11-25 13:05:25.700 I #3104 Agent Collecting Properties

      2013-11-25 13:05:25.700 I #3104 Agent Collecting IP address using Internet Manager

      2013-11-25 13:05:25.731 I #3104 naInet HTTP Session initialized

      2013-11-25 13:05:25.731 I #3104 imsite Connecting to site: <ePO IP Address> on port: 443

      2013-11-25 13:05:25.778 I #3104 naInet HTTP Session closed

      2013-11-25 13:05:25.778 I #3104 Manage Collecting Properties

      2013-11-25 13:05:25.778 I #3104 Manage Initializing Event Interface

      2013-11-25 13:05:25.794 I #3104 Manage EpoEventInf Interface: Initialization succeeded.

      2013-11-25 13:05:25.794 i #3104 Manage Collecting Properties

      2013-11-25 13:05:26.231 I #3104 Manage CEnforceProperties::GetPluginProperties() - FAILED - "VIRUSCAN8800|SYSPROPS1000|PCR_____1000|HOSTIPS_8000|EPOAGENT3000|" Error(-2147417851)

      2013-11-25 13:05:26.262 I #3104 Manage DeInitializing Event Interface

      2013-11-25 13:05:26.262 I #3104 Manage EpoEventInf Interface: Deinitialization succeeded.

      2013-11-25 13:05:26.262 I #3104 Agent Agent is sending FULL PROPERTIES

      2013-11-25 13:05:26.262 I #3104 Agent Forwarding all events

      2013-11-25 13:05:26.262 I #3104 Agent Forward all events request received

      2013-11-25 13:05:26.262 I #3096 Agent Started processing a package..

      2013-11-25 13:05:26.262 I #3112 Agent Agent event wakeup, processing events

      2013-11-25 13:05:26.262 I #3096 Agent Preparing Props Package

      2013-11-25 13:05:26.262 i #3112 Agent Agent is looking for events to upload

      2013-11-25 13:05:26.262 I #3112 Agent Agent did not find any events to upload

      2013-11-25 13:05:26.278 I #3096 Agent Collecting IP address using Internet Manager

      2013-11-25 13:05:26.325 I #3096 naInet HTTP Session initialized

      2013-11-25 13:05:26.325 I #3096 imsite Connecting to site: <ePO IP Address> on port: 443

      2013-11-25 13:05:26.372 I #3096 naInet HTTP Session closed

      2013-11-25 13:05:26.372 I #3096 SpiPkgr Using sequence number 3398

      2013-11-25 13:05:26.372 i #3096 Agent Agent communication session started

      2013-11-25 13:05:26.372 i #3096 Agent Agent is sending FULL PROPS package to ePO server

      2013-11-25 13:05:26.372 i #3096 Agent Agent is connecting to ePO server

      2013-11-25 13:05:26.419 I #3096 imutils Trying with site: <ePO IP Address>:8050

      2013-11-25 13:05:26.419 I #3096 naInet HTTP Session initialized

      2013-11-25 13:05:26.419 I #3096 imsite  Upload from: C:\Documents and Settings\All Users\Application Data\McAfee\Common Framework\Unpack\pkg00130298799262620000_2646837168.spkg

      2013-11-25 13:05:26.419 I #3096 imsite  Upload response target: C:\Documents and Settings\All Users\Application Data\McAfee\Common Framework\Unpack\pkg00130298799263720000_2567150075.spkg

      2013-11-25 13:05:26.684 I #3096 imsite NaInet library returned code == 13

      2013-11-25 13:05:26.684 I #3096 naInet HTTP Session closed

      2013-11-25 13:05:26.684 i #3096 Agent No package received from ePO Server

      2013-11-25 13:05:26.684 i #3096 Agent Agent communication session closed

      2013-11-25 13:05:40.950 i #3120 Agent Agent Started Enforcing policies

      2013-11-25 13:05:40.950 I #3120 Agent Thread time-out occurred

      2013-11-25 13:05:40.950 I #3120 Manage Enforcing policies

      2013-11-25 13:05:40.950 i #3120 Manage Enforcing Policies for McAfee Agent

      2013-11-25 13:05:40.950 I #3120 Agent CePOAgent::EnforcePolicy priority=-2

      2013-11-25 13:05:40.950 I #3120 Agent Enforcing policies

      2013-11-25 13:05:40.950 I #3120 LstnSvr Enforcing Policies

      2013-11-25 13:05:40.950 I #3120 Logging Enforcing policies

      2013-11-25 13:05:40.950 I #3120 Manage Enforcing policies

      2013-11-25 13:05:40.966 I #3120 UsrSpCt Enforcing policies

      2013-11-25 13:05:40.966 I #3120 Sched >>--CSchedule::EnforcePolicy

      2013-11-25 13:05:40.966 I #3120 Sched >>--CSchedule::ModifyTask

      2013-11-25 13:05:40.966 I #3120 Sched <<--CSchedule::ModifyTask

      2013-11-25 13:05:40.981 I #3120 Sched Auto Update Task WORKSTATIONS - Last run time(local) is Mon Nov 25 12:13:00 2013

      2013-11-25 13:05:40.981 I #3120 Sched

      2013-11-25 13:05:40.981 I #3120 Sched 0 fields of the task 17 are updated successfully

      2013-11-25 13:05:40.981 I #3120 Sched RunAtEnforcementEnabled not found in the task settings

      2013-11-25 13:05:40.981 I #3120 Sched >>--CSchedule::ModifyTask

      2013-11-25 13:05:40.981 I #3120 Sched <<--CSchedule::ModifyTask

      2013-11-25 13:05:40.997 I #3120 Sched Emergency DAT Update - Last run time is : not run yet

      2013-11-25 13:05:40.997 I #3120 Sched 0 fields of the task 2 are updated successfully

      2013-11-25 13:05:40.997 I #3120 Sched RunAtEnforcementEnabled not found in the task settings

      2013-11-25 13:05:40.997 I #3120 Sched >>--CSchedule::ModifyTask

      2013-11-25 13:05:40.997 I #3120 Sched <<--CSchedule::ModifyTask

      2013-11-25 13:05:40.997 I #3120 Sched McAfee Agent Deployment Task WORKSTATIONS - Last run time(local) is Fri Nov 22 09:52:01 2013

      2013-11-25 13:05:40.997 I #3120 Sched

      2013-11-25 13:05:40.997 I #3120 Sched 0 fields of the task 8 are updated successfully

      2013-11-25 13:05:40.997 I #3120 Sched >>--CSchedule::ModifyTask

      2013-11-25 13:05:40.997 I #3120 Sched <<--CSchedule::ModifyTask

      2013-11-25 13:05:41.012 I #3120 Sched Deploy McAfee HIPS 8 - Last run time(local) is Mon Nov 25 08:05:41 2013

      2013-11-25 13:05:41.012 I #3120 Sched

      2013-11-25 13:05:41.012 I #3120 Sched 0 fields of the task 98 are updated successfully

      2013-11-25 13:05:41.012 I #3120 Sched >>--CSchedule::GetTask

      2013-11-25 13:05:41.012 I #3120 Sched <<--CSchedule::GetTask

      2013-11-25 13:05:41.012 I #3120 Sched >>--CSchedule::GetTask

      2013-11-25 13:05:41.012 I #3120 Sched <<--CSchedule::GetTask

      2013-11-25 13:05:41.028 I #3120 Sched >>--CSchedule::GetTask

      2013-11-25 13:05:41.028 I #3120 Sched <<--CSchedule::GetTask

      2013-11-25 13:05:41.028 I #3120 Sched >>--CSchedule::GetTask

      2013-11-25 13:05:41.028 I #3120 Sched <<--CSchedule::GetTask

      2013-11-25 13:05:41.028 I #3120 Sched <<--CSchedule::EnforcePolicy

      2013-11-25 13:05:41.028 I #3120 Manage Initializing Event Interface

      2013-11-25 13:05:41.028 I #3120 Manage EpoEventInf Interface: Initialization succeeded.

      2013-11-25 13:05:41.106 i #3120 Manage Enforcing Policies for EPOAGENT3000META

      2013-11-25 13:05:41.122 i #3120 Manage Enforcing Policies for EPOAGENT3000

      2013-11-25 13:05:41.137 I #3120 Manage DeInitializing Event Interface

      2013-11-25 13:05:41.137 I #3120 Manage EpoEventInf Interface: Deinitialization succeeded.

      2013-11-25 13:05:41.137 i #3120 Agent Agent finished Enforcing policies

      2013-11-25 13:05:41.137 i #3120 Agent Next policy enforcement in 60 minutes

      2013-11-25 13:10:26.262 I #3112 Agent Sending the next batch of immediate events

      2013-11-25 13:10:26.262 i #3112 Agent Agent is looking for events to upload

      2013-11-25 13:10:26.262 I #3112 Agent Agent did not find any events to upload

      2013-11-25 13:15:26.262 I #3112 Agent Sending the next batch of immediate events

      2013-11-25 13:15:26.262 i #3112 Agent Agent is looking for events to upload

      2013-11-25 13:15:26.262 I #3112 Agent Agent did not find any events to upload

      2013-11-25 13:18:34.325 I #388 FrmSvc Stopping Subsystem <User Space Controller>

      2013-11-25 13:18:34.325 I #388 FrmSvc Stopping Subsystem <Listen Server>

      2013-11-25 13:18:34.434 I #3312 LstnSvr CHttpServer::StopListening - m_pListen->Close, SetHttpPortBound(FALSE)

      2013-11-25 13:18:34.434 I #3356 LstnSvr WQThreadProc:  Stopping thread 3356...

      2013-11-25 13:18:34.434 I #3352 LstnSvr WQThreadProc:  Stopping thread 3352...

      2013-11-25 13:18:34.434 I #3348 LstnSvr WQThreadProc:  Stopping thread 3348...

      2013-11-25 13:18:34.434 I #3344 LstnSvr WQThreadProc:  Stopping thread 3344...

      2013-11-25 13:18:34.434 I #3408 LstnSvr WQThreadProc:  Stopping thread 3408...

      2013-11-25 13:18:34.434 I #3396 LstnSvr WQThreadProc:  Stopping thread 3396...

      2013-11-25 13:18:34.434 I #3340 LstnSvr WQThreadProc:  Stopping thread 3340...

      2013-11-25 13:18:34.434 I #3376 LstnSvr WQThreadProc:  Stopping thread 3376...

      2013-11-25 13:18:34.434 I #3320 LstnSvr WQThreadProc:  Stopping thread 3320...

      2013-11-25 13:18:34.434 I #3372 LstnSvr WQThreadProc:  Stopping thread 3372...

      2013-11-25 13:18:34.434 I #3384 LstnSvr WQThreadProc:  Stopping thread 3384...

      2013-11-25 13:18:34.434 I #3336 LstnSvr WQThreadProc:  Stopping thread 3336...

      2013-11-25 13:18:34.434 I #3332 LstnSvr WQThreadProc:  Stopping thread 3332...

      2013-11-25 13:18:34.434 I #3328 LstnSvr WQThreadProc:  Stopping thread 3328...

      2013-11-25 13:18:34.466 I #3324 LstnSvr WQThreadProc:  Stopping thread 3324...

      2013-11-25 13:18:34.466 I #3400 LstnSvr WQThreadProc:  Stopping thread 3400...

      2013-11-25 13:18:34.466 I #3404 LstnSvr WQThreadProc:  Stopping thread 3404...

      2013-11-25 13:18:34.481 I #3392 LstnSvr WQThreadProc:  Stopping thread 3392...

      2013-11-25 13:18:34.481 I #3380 LstnSvr WQThreadProc:  Stopping thread 3380...

      2013-11-25 13:18:34.481 I #3364 LstnSvr WQThreadProc:  Stopping thread 3364...

      2013-11-25 13:18:34.481 I #3360 LstnSvr WQThreadProc:  Stopping thread 3360...

      2013-11-25 13:18:34.481 I #3368 LstnSvr WQThreadProc:  Stopping thread 3368...

      2013-11-25 13:18:34.481 I #3388 LstnSvr WQThreadProc:  Stopping thread 3388...

      2013-11-25 13:18:34.497 I #3312 LstnSvr CHttpServer::~CHttpServer

      2013-11-25 13:18:34.497 x #388 LstnSvr Subsystem stopped

      2013-11-25 13:18:34.497 I #388 FrmSvc Stopping Subsystem <Agent>

      2013-11-25 13:18:34.497 I #388 Agent Agent mode is 1 ( 1 for managed mode, 0 for unmanaged mode )

      2013-11-25 13:18:34.497 x #388 Agent Subsystem stopping....

      2013-11-25 13:18:34.512 I #3144 Agent Agent Data Channel Router thread terminating

      2013-11-25 13:18:34.528 I #3136 Agent Agent Data Channel Request Handler worker thread terminating

      2013-11-25 13:18:34.575 I #3124 Agent Agent Data Channel worker thread terminating

      2013-11-25 13:18:34.575 I #3100 Agent Agent communication thread terminating

      2013-11-25 13:18:34.591 I #3104 Agent Agent worker thread terminating

      2013-11-25 13:18:34.591 I #3112 Agent Agent event worker thread terminating

      2013-11-25 13:18:34.591 I #3116 Agent Agent Immediate Events  worker thread terminating

      2013-11-25 13:18:34.591 I #3120 Agent Agent policy worker thread terminating

      2013-11-25 13:18:34.591 I #3096 Agent Agent communication thread terminating

      2013-11-25 13:18:34.591 x #388 Agent Subsystem stopped

      2013-11-25 13:18:34.591 I #388 FrmSvc Stopping Subsystem <Scheduler>

      2013-11-25 13:18:34.637 i #388 Sched The Scheduler is shutting down

      2013-11-25 13:18:34.637 i #388 Sched Scheduler is now stopped

      2013-11-25 13:18:34.637 I #388 FrmSvc Stopping Subsystem <Updater>

      2013-11-25 13:18:34.637 I #388 Updater UninitSense

      2013-11-25 13:18:34.809 I #388 updsubs Stopping updater subsystem

      2013-11-25 13:18:34.841 i #388 Updater

      2013-11-25 13:18:34.841 I #388 FrmSvc Stopping Subsystem <Management>

      2013-11-25 13:18:34.934 I #472 Manage Got shutdown event

      2013-11-25 13:18:34.934 I #472 Manage Mangement plugin watch worker thread terminating

      2013-11-25 13:18:34.934 x #388 Manage Subsystem stopped

      2013-11-25 13:18:34.966 I #388 LpcConnMgr Stopping lpc connection manager

      2013-11-25 13:18:34.966 I #388 LpcConnMgr Cleaning up heart beat component

      2013-11-25 13:18:34.966 I #388 LpcConnMgr Cleaning up lpc server

      2013-11-25 13:18:34.966 I #388 WinLpcSvr Requesting lpc server stop

      2013-11-25 13:18:34.966 I #1344 WinLpcSvr Received shutdown request

      2013-11-25 13:18:34.966 I #1344 WinLpcSvr Lpc server is down

      2013-11-25 13:18:34.966 I #388 LpcConnMgr Cleaning up message queue

      2013-11-25 13:18:34.966 I #388 MsgQueue Cleaning up message queue

      2013-11-25 13:18:34.966 I #388 MfeLpcFactory Successfully released mfelpc objects

      2013-11-25 13:18:34.966 I #388 FrmSvc Stopping Subsystem <Logging>

      2013-11-25 13:18:34.966 x #388 Logging

      2013-11-25 13:18:35.622 I #388 FrmSvc Service stopped

      2013-11-25 13:18:35.637 I #2028 FrmSvc Set COM launch permissions and service settings

      2013-11-25 13:18:35.637 I #2028 FrmSvc END

      2013-11-25 13:19:01.403 E #4664 Logging addAgentInfoToLog GUID query error 2

      2013-11-25 13:19:01.419 I #4664 FrmSvc START cmdline="C:\Program Files\McAfee\Common Framework\FrameworkService.exe" /ServiceStart

      2013-11-25 13:19:01.419 I #4664 FrmSvc ServiceStart

      2013-11-25 13:19:01.419 I #4664 FrmSvc Running

      2013-11-25 13:19:01.434 I #2656 FrmSvc Starting Subsystem <Logging>

      2013-11-25 13:19:01.434 x #2656 Logging Subsystem started

      2013-11-25 13:19:01.434 I #2656 FrmSvc Starting Subsystem <User Space Controller>

      2013-11-25 13:19:01.466 I #2656 FrmSvc Starting Subsystem <Management>

      2013-11-25 13:19:01.466 I #6132 Manage Mangement plugin watch worker thread started

      2013-11-25 13:19:01.466 I #2656 Cryptshim Initializing crypto library

      2013-11-25 13:19:01.466 I #2656 Cryptshim Using C:\Documents and Settings\All Users\Application Data\McAfee\Common Framework\keystore as keystore path

      2013-11-25 13:19:01.466 I #2656 Cryptshim Using C:\Program Files\McAfee\Common Framework\FrameworkService.sig as exe signature file path

      2013-11-25 13:19:01.544 I #2656 MfeCryptC RSA version : NIST Library Version 2.1.0.0

      2013-11-25 13:19:01.544 I #2656 MfeCryptC

      2013-11-25 13:19:01.544 I #2656 MfeCryptC RSA crypto role : User Role

      2013-11-25 13:19:01.544 I #2656 MfeCryptC

      2013-11-25 13:19:01.544 I #2656 MfeCryptC RSA crypto mode : NON-FIPS Mode

      2013-11-25 13:19:01.544 I #2656 MfeCryptC

      2013-11-25 13:19:01.575 I #2656 Cryptshim Successfully initialized crypto library

      2013-11-25 13:19:01.622 I #2656 Datastore Did not find setting AssignmentList in section Policy for software ID PolicyRoot

      2013-11-25 13:19:01.716 I #6132 Manage Plugin registry change detected

      2013-11-25 13:19:01.716 I #6132 Manage Plugin registry change detected

      2013-11-25 13:19:01.716 I #6132 Manage Plugin registry change detected

      2013-11-25 13:19:01.716 I #6132 Manage Plugin registry change detected

      2013-11-25 13:19:01.716 I #6132 Manage Plugin registry change detected

      2013-11-25 13:19:01.716 I #6132 Manage Plugin registry change detected

      2013-11-25 13:19:01.716 I #6132 Manage Plugin registry change detected

      2013-11-25 13:19:01.716 I #6132 Manage Plugin registry change detected

      2013-11-25 13:19:01.716 I #6132 Manage Plugin registry change detected

      2013-11-25 13:19:01.716 I #6132 Manage Plugin registry change detected

      2013-11-25 13:19:01.716 I #6132 Manage Plugin registry change detected

      2013-11-25 13:19:01.716 I #6132 Manage Plugin registry change detected

      2013-11-25 13:19:01.731 E #2656 ubpUtls Error trace:

      2013-11-25 13:19:01.731 E #2656 ubpUtls  [LsaEnumerateLogonSessions]->

      2013-11-25 13:19:01.731 E #2656 ubpUtls   error -2147024888: Not enough storage is available to process this command.

      2013-11-25 13:19:01.731 I #2656 Manage Failed to get list of logged on users (HR 0x80070008)

      2013-11-25 13:19:01.747 I #2656 LpcConnMgr Initializing lpc data

      2013-11-25 13:19:01.747 I #2656 LpcConnMgr Registering software id EPOAGENT3000 with a hash value of 197307931

      2013-11-25 13:19:01.747 I #2656 LpcConnMgr Registering software id CMNUPD__3000 with a hash value of 1496913389

      2013-11-25 13:19:01.747 I #2656 LpcConnMgr Starting lpc connection manager

      2013-11-25 13:19:01.747 I #2656 LpcConnMgr Setting up lpc server

      2013-11-25 13:19:01.747 I #2656 LpcConnMgr lpc server path \\.\pipe\ma_named_pipe

      2013-11-25 13:19:01.747 I #2656 WinLpcSvr Initializing LPC server

      2013-11-25 13:19:01.747 I #2656 WinLpcSvr Using randomized name \\.\pipe\ma_named_pipe175110126 for first instance "\\.\pipe\ma_named_pipe"

      2013-11-25 13:19:01.747 I #2656 WinLpcSvr Setting server path to \\.\pipe\ma_named_pipe175110126

      2013-11-25 13:19:01.747 I #2656 WinLpcSvr Starting LPC server

      2013-11-25 13:19:01.747 I #2656 WinLpcSvr Creating server run thread

      2013-11-25 13:19:01.747 I #2656 WinLpcSvr server started successfully

      2013-11-25 13:19:01.747 I #2656 LpcConnMgr Setting up message queue

      2013-11-25 13:19:01.747 I #2656 LpcConnMgr Setting up heart beat component

      2013-11-25 13:19:01.747 x #2656 Manage Subsystem started

      2013-11-25 13:19:01.762 I #2656 FrmSvc Starting Subsystem <Updater>

      2013-11-25 13:19:01.762 I #2656 Updater loaded sensapi.dll.

      2013-11-25 13:19:01.762 I #2656 Updater network connected.

      2013-11-25 13:19:01.762 I #2656 Updater InitSense

      2013-11-25 13:19:01.778 I #2656 updsubs Starting updater subsystem

      2013-11-25 13:19:01.778 i #2656 Updater Subsystem started

      2013-11-25 13:19:01.794 I #2656 FrmSvc Starting Subsystem <Scheduler>

      2013-11-25 13:19:01.794 I #2656 Sched >>--CSchedule::Start

      2013-11-25 13:19:01.794 I #2656 Sched Glbs.szMyPlatform: WXPW:5:1:3

      2013-11-25 13:19:01.825 I #2656 Sched {A14CD6FC-3BA8-4703-87BF-E3247CE382F5} - Last run time is : not run yet

      2013-11-25 13:19:01.825 I #2656 Sched CNaiSchedule::GetRandomizedDelayMins() : 23

      2013-11-25 13:19:01.825 i #2656 Sched Next time(local) of task {A14CD6FC-3BA8-4703-87BF-E3247CE382F5}: Monday, November 25, 2013 5:23:00 PM

      2013-11-25 13:19:01.841 I #2656 Sched All the tasks are successfully loaded from the file

      2013-11-25 13:19:01.841 i #2656 Sched Scheduler is now running

      2013-11-25 13:19:01.841 I #2656 Sched <<--CSchedule::Start

      2013-11-25 13:19:01.856 I #2656 FrmSvc Starting Subsystem <Agent>

      2013-11-25 13:19:01.856 I #2656 Agent Agent mode is 1 ( 1 for managed mode, 0 for unmanaged mode )

      2013-11-25 13:19:01.856 I #2656 Agent Subsystem starting...

      2013-11-25 13:19:02.356 I #2656 Agent Generating agent keys

      2013-11-25 13:19:03.169 I #2656 MfeCryptC Successfully freed key item

      2013-11-25 13:19:03.169 I #2656 MfeCryptC

      2013-11-25 13:19:03.169 I #2656 MfeCryptC Successfully freed key item

      2013-11-25 13:19:03.169 I #2656 MfeCryptC

      2013-11-25 13:19:03.184 I #2656 Agent Successfully generated agent keys

      2013-11-25 13:19:03.184 i #2656 Agent Generating Agent ID...

      2013-11-25 13:19:03.184 I #2656 CmnLibLegacy cmnlib_get_is_embedded(), returning FALSE

      2013-11-25 13:19:03.184 I #2656 SpiPkgr isEmbeddedWindows is false seqNumFile is C:\Documents and Settings\All Users\Application Data\McAfee\Common Framework\seqnum.bin

      2013-11-25 13:19:03.184 I #2656 SpiPkgr Specifying spipe 5.0 support in key package

      2013-11-25 13:19:03.184 I #2656 Cryptshim Successfully freed key data

      2013-11-25 13:19:03.184 I #4524 Agent Agent communication thread started

      2013-11-25 13:19:03.184 I #4684 Agent Agent data channel communication thread started

      2013-11-25 13:19:03.184 i #5088 Agent Agent will connect to Server in randomized 10 minutes interval

      2013-11-25 13:19:03.184 I #6088 Agent Agent event worker thread started

      2013-11-25 13:19:03.184 I #5376 Agent Agent Immediate Events worker thread started

      2013-11-25 13:19:03.184 i #5520 Agent Next policy enforcement in 5 minutes

      2013-11-25 13:19:03.184 I #2104 Agent Agent Data Channel worker thread started

      2013-11-25 13:19:03.184 I #2104 Agent Agent Data Channel work wakeup, processing items

      2013-11-25 13:19:03.184 I #6088 Agent ASC have already done once

      2013-11-25 13:19:03.184 I #5132 Agent Agent Data Channel Request Handler worker thread started

      2013-11-25 13:19:03.184 I #2656 Agent Subsystem started

      2013-11-25 13:19:03.184 I #5408 Agent Agent Data Channel Router thread started

      2013-11-25 13:19:03.184 I #5088 Agent Agent worker thread started

      2013-11-25 13:19:03.184 i #5088 Agent Agent will connect to Server in : 3 minutes and 0 seconds

      2013-11-25 13:19:03.200 I #2656 FrmSvc Starting Subsystem <Listen Server>

      2013-11-25 13:19:03.200 I #5092 LstnSvr CAsyncSocket::StartListening (SOCK_STREAM) LISTENING... TRUE

      2013-11-25 13:19:03.200 I #5092 LstnSvr ListenServer:: IPv6 is not enabled

      2013-11-25 13:19:03.200 x #2656 LstnSvr Subsystem started

      2013-11-25 13:19:03.200 I #2656 FrmSvc Service started

      2013-11-25 13:19:12.450 i #5520 Agent Agent Started Enforcing policies

      2013-11-25 13:19:12.450 I #5520 Agent Thread signal occurred

      2013-11-25 13:19:12.450 I #5520 Manage Enforcing policies

      2013-11-25 13:19:12.450 i #5520 Manage Enforcing Policies for McAfee Agent

      2013-11-25 13:19:12.450 I #5520 Agent CePOAgent::EnforcePolicy priority=-2

      2013-11-25 13:19:12.450 I #5520 Agent Enforcing policies

      2013-11-25 13:19:12.450 I #5520 LstnSvr Enforcing Policies

      2013-11-25 13:19:12.481 I #5092 LstnSvr CHttpServer::StopListening - m_pListen->Close, SetHttpPortBound(FALSE)

      2013-11-25 13:19:12.481 I #5768 LstnSvr WQThreadProc:  Stopping thread 5768...

      2013-11-25 13:19:12.481 I #1956 LstnSvr WQThreadProc:  Stopping thread 1956...

      2013-11-25 13:19:12.481 I #2568 LstnSvr WQThreadProc:  Stopping thread 2568...

      2013-11-25 13:19:12.481 I #4784 LstnSvr WQThreadProc:  Stopping thread 4784...

      2013-11-25 13:19:12.481 I #2980 LstnSvr WQThreadProc:  Stopping thread 2980...

      2013-11-25 13:19:12.481 I #4936 LstnSvr WQThreadProc:  Stopping thread 4936...

      2013-11-25 13:19:12.481 I #888 LstnSvr WQThreadProc:  Stopping thread 888...

      2013-11-25 13:19:12.481 I #5224 LstnSvr WQThreadProc:  Stopping thread 5224...

      2013-11-25 13:19:12.481 I #4740 LstnSvr WQThreadProc:  Stopping thread 4740...

      2013-11-25 13:19:12.481 I #5212 LstnSvr WQThreadProc:  Stopping thread 5212...

      2013-11-25 13:19:12.481 I #5208 LstnSvr WQThreadProc:  Stopping thread 5208...

      2013-11-25 13:19:12.481 I #5348 LstnSvr WQThreadProc:  Stopping thread 5348...

      2013-11-25 13:19:12.481 I #5184 LstnSvr WQThreadProc:  Stopping thread 5184...

      2013-11-25 13:19:12.481 I #5200 LstnSvr WQThreadProc:  Stopping thread 5200...

      2013-11-25 13:19:12.481 I #5752 LstnSvr WQThreadProc:  Stopping thread 5752...

      2013-11-25 13:19:12.481 I #4832 LstnSvr WQThreadProc:  Stopping thread 4832...

      2013-11-25 13:19:12.481 I #3828 LstnSvr WQThreadProc:  Stopping thread 3828...

      2013-11-25 13:19:12.481 I #6072 LstnSvr WQThreadProc:  Stopping thread 6072...

      2013-11-25 13:19:12.481 I #2664 LstnSvr WQThreadProc:  Stopping thread 2664...

      2013-11-25 13:19:12.481 I #3004 LstnSvr WQThreadProc:  Stopping thread 3004...

      2013-11-25 13:19:12.481 I #5864 LstnSvr WQThreadProc:  Stopping thread 5864...

      2013-11-25 13:19:12.481 I #5172 LstnSvr WQThreadProc:  Stopping thread 5172...

      2013-11-25 13:19:12.481 I #4380 LstnSvr WQThreadProc:  Stopping thread 4380...

      2013-11-25 13:19:12.481 I #5092 LstnSvr CHttpServer::~CHttpServer

      2013-11-25 13:19:12.481 x #5520 LstnSvr Subsystem stopped

      2013-11-25 13:19:12.481 I #2860 LstnSvr CAsyncSocket::StartListening (SOCK_STREAM) LISTENING... TRUE

      2013-11-25 13:19:12.481 I #2860 LstnSvr ListenServer:: IPv6 is not enabled

      2013-11-25 13:19:12.481 I #2860 LstnSvr LstnSvr ListenServerSocket::SetUDPSocket socket not created for  IPv6 support

      2013-11-25 13:19:12.481 x #5520 LstnSvr Subsystem started

      2013-11-25 13:19:12.481 I #5520 Logging Enforcing policies

      2013-11-25 13:19:12.481 I #5520 Manage Enforcing policies

      2013-11-25 13:19:12.497 I #5520 Datastore Did not find setting LicenseKey in section EPOAGENT3000META for software ID EPOAGENT3000META

      2013-11-25 13:19:12.497 I #5520 UsrSpCt Enforcing policies

      2013-11-25 13:19:12.497 I #5520 UsrSpCt Token not found. Will try to get it from shell

      2013-11-25 13:19:12.497 I #5520 UsrSpCt Found shell token

      2013-11-25 13:19:12.497 I #5520 UsrSpCt Try to Launch UdaterUI Again

      2013-11-25 13:19:12.887 I #4724 Logging StartReadingMessages (\\.\mailslot\{76889C92-A0C0-46e3-A4E1-1D6A5439B8DD}00000d14, 0x7f57, 4)

      2013-11-25 13:19:12.887 I #4724 Logging - using empty 0

      2013-11-25 13:19:12.887 I #5520 Sched >>--CSchedule::EnforcePolicy

      2013-11-25 13:19:12.903 I #5520 Sched <<--CSchedule::EnforcePolicy

      2013-11-25 13:19:12.903 I #5520 Manage Initializing Event Interface

      2013-11-25 13:19:13.044 I #5520 Manage EpoEventInf Interface: Initialization succeeded.

      2013-11-25 13:19:13.044 I #5520 Manage Generating Management event:EventId=2422:Severity=3:ProductId=VIRUSCAN8800:EventType=Policy Enforcement:Error=50

      2013-11-25 13:19:13.044 I #5520 Manage EpoEventInf Interface: Event element created.

      2013-11-25 13:19:13.044 I #5520 Manage Generating Management event:EventId=2422:Severity=3:ProductId=HOSTIPS_8000:EventType=Policy Enforcement:Error=50

      2013-11-25 13:19:13.044 I #5520 Manage EpoEventInf Interface: Event element created.

      2013-11-25 13:19:13.059 i #5520 Manage Enforcing Policies for EPOAGENT3000META

      2013-11-25 13:19:13.106 i #5520 Manage Enforcing Policies for EPOAGENT3000

      2013-11-25 13:19:13.544 I #5520 Manage EpoEventInf Interface: Management event created.

      2013-11-25 13:19:13.544 I #5520 Manage DeInitializing Event Interface

      2013-11-25 13:19:13.544 I #5520 Manage EpoEventInf Interface: Deinitialization succeeded.

      2013-11-25 13:19:13.544 i #5520 Agent Agent finished Enforcing policies

      2013-11-25 13:19:13.544 i #5520 Agent Next policy enforcement in 5 minutes

      2013-11-25 13:20:01.716 I #6132 Manage Loading plugin list from registry

       

      Anyone know what could be going on here?  I can go back further in the log if necessary.