7 Replies Latest reply on May 7, 2014 12:08 PM by JoeBidgood

    Loss of EPo to Agent Communication

    cg-windstream

      I have had a couple of client-servers with agents which had been communication with EPo and updating fine.  Then on unrelated dates, (months apart, different subnets and all that) .

       

      • We are using 1 main EPo 4.6 Server and client Agents 4.6 (No secondary's or supers)
      • The client is able to telnet to the EPo Server via ports 443 & 80. 
      • The Epo Server is able to telnet to the client via 8081. 
      • (Same config as all the currently updating systems)
      • I've tried the ping and wakeup agents buttons on the console with no change (of course).

       

      I "fixed" one of them by reinstalling the agent but apparetnly that also had the effect of removing all the old info in the EPo database.

       

      Before I do this to the 2nd client-server, I figured I'd ck with you more experienced admins.

       

      THX

      CG

        • 1. Re: Loss of EPo to Agent Communication
          JoeBidgood

          First thing is to check the client end - start with the agent log, and see what errors are recorded when it tries to communicate. Feel free to attach a log here if you like and we can take a look.

           

          HTH -

           

          Joe

          1 of 1 people found this helpful
          • 2. Re: Loss of EPo to Agent Communication
            cg-windstream

            Thanks Joe,

             

            Here's the log.  I don't see anything useful but then I don't really know what I'm looking for.  Last Communication                                                                     7/9/13 9:31:41 PM

             

             

            4/4/2013    3:23:11 PM    Would be blocked by Access Protection rule  (rule is currently not enforced)     PAETECAUTH\mcafeesrv    C:\WINDOWS\Explorer.EXE    C:\WINDOWS\Temp\{CE15D1B6-19B6-4D4D-8F43-CF5D2C3356FF}\nailite.dll    Common Standard Protection:Prevent common programs from running files from the Temp folder    Action blocked : Execute

            5/2/2013    6:18:15 PM    Would be blocked by Access Protection rule  (rule is currently not enforced)     PAETECAUTH\e0148985    C:\Program Files\Internet Explorer\iexplore.exe    C:\Documents and Settings\e0148985\Local Settings\Temporary Internet Files\Content.IE5\GPM7CPM3\JavaSetup7u21[1].exe    Common Standard Protection:Prevent common programs from running files from the Temp folder    Action blocked : Execute

            5/9/2013    2:46:46 PM    Would be blocked by Access Protection rule  (rule is currently not enforced)     PAETECAUTH\e0148985    C:\Program Files\Internet Explorer\iexplore.exe    C:\Documents and Settings\e0148985\Local Settings\Temporary Internet Files\Content.IE5\96VBYAVX\Firefox%20Setup%2020.0.1[1].exe    Common Standard Protection:Prevent common programs from running files from the Temp folder    Action blocked : Execute

            5/9/2013    2:47:25 PM    Would be blocked by Access Protection rule  (rule is currently not enforced)     PAETECAUTH\e0148985    C:\WINDOWS\Explorer.EXE    C:\Documents and Settings\e0148985\Local Settings\Temp\1\7zS3.tmp\setup.exe    Common Standard Protection:Prevent common programs from running files from the Temp folder    Action blocked : Execute

            5/9/2013    2:47:42 PM    Would be blocked by Access Protection rule  (rule is currently not enforced)     PAETECAUTH\e0148985    C:\WINDOWS\Explorer.EXE    C:\Documents and Settings\e0148985\Local Settings\Temp\1\7zS3.tmp\setup.exe    Common Standard Protection:Prevent common programs from running files from the Temp folder    Action blocked : Execute

            5/9/2013    2:47:52 PM    Would be blocked by Access Protection rule  (rule is currently not enforced)     PAETECAUTH\e0148985    C:\WINDOWS\Explorer.EXE    C:\Documents and Settings\e0148985\Local Settings\Temp\1\7zS3.tmp\setup.exe    Common Standard Protection:Prevent common programs from running files from the Temp folder    Action blocked : Execute

            5/9/2013    2:48:38 PM    Would be blocked by Access Protection rule  (rule is currently not enforced)     PAETECAUTH\e0148985    C:\WINDOWS\Explorer.EXE    C:\Documents and Settings\e0148985\Local Settings\Temp\1\7zS3.tmp\setup.exe    Common Standard Protection:Prevent common programs from running files from the Temp folder    Action blocked : Execute

            7/18/2013    9:32:17 PM    Would be blocked by Access Protection rule  (rule is currently not enforced)     PAETECAUTH\ndk40594    C:\Program Files\Internet Explorer\IEXPLORE.EXE    C:\Documents and Settings\nkauble\Local Settings\Temporary Internet Files\Content.IE5\GPM7CPM3\JavaSetup7u25[1].exe    Common Standard Protection:Prevent common programs from running files from the Temp folder    Action blocked : Execute

            7/18/2013    9:33:15 PM    Would be blocked by Access Protection rule  (rule is currently not enforced)     PAETECAUTH\ndk40594    C:\WINDOWS\Explorer.EXE    C:\Documents and Settings\nkauble\Local Settings\Temp\3\MSI4.tmp    Common Standard Protection:Prevent common programs from running files from the Temp folder    Action blocked : Execute

            1/8/2014    9:24:36 PM    Would be blocked by Access Protection rule  (rule is currently not enforced)     PAETECAUTH\e0148985    C:\WINDOWS\Explorer.EXE    C:\Documents and Settings\e0148985\Local Settings\Temp\2\jre-7u45-windows-i586-iftw.exe    Common Standard Protection:Prevent common programs from running files from the Temp folder    Action blocked : Execute

            4/10/2014    8:34:56 PM    Would be blocked by Access Protection rule  (rule is currently not enforced)     PAETECAUTH\mcafeesrv    C:\WINDOWS\Explorer.EXE    C:\Documents and Settings\McAfeeSRV\Local Settings\Temp\2\GLB1.tmp    Common Standard Protection:Prevent common programs from running files from the Temp folder    Action blocked : Execute

            4/10/2014    8:55:34 PM    Would be blocked by Access Protection rule  (rule is currently not enforced)     PAETECAUTH\mcafeesrv    C:\WINDOWS\Explorer.EXE    C:\Documents and Settings\McAfeeSRV\Local Settings\Temp\2\GLB1.tmp    Common Standard Protection:Prevent common programs from running files from the Temp folder    Action blocked : Execute

            4/10/2014    9:10:24 PM    Would be blocked by Access Protection rule  (rule is currently not enforced)     PAETECAUTH\mcafeesrv    C:\WINDOWS\Explorer.EXE    C:\Documents and Settings\McAfeeSRV\Local Settings\Temp\2\GLB5.tmp    Common Standard Protection:Prevent common programs from running files from the Temp folder    Action blocked : Execute

            4/10/2014    9:10:39 PM    Would be blocked by Access Protection rule  (rule is currently not enforced)     PAETECAUTH\mcafeesrv    C:\WINDOWS\Explorer.EXE    C:\Documents and Settings\McAfeeSRV\Local Settings\Temp\2\GLB9.tmp    Common Standard Protection:Prevent common programs from running files from the Temp folder    Action blocked : Execute

            • 3. Re: Loss of EPo to Agent Communication
              JoeBidgood

              That looks more like the access protection log - the one we're after is the agent log, which will be called agent_<name of the machine>.log and will live in %programdata%\Mcafee\DB by default. If you can zip and attach the whole file here, that would be great - please don't cut and paste the contents as it will probably be quite large

               

              Thanks -

               

              Joe

              1 of 1 people found this helpful
              • 4. Re: Loss of EPo to Agent Communication
                cg-windstream

                Details, details.  Thanks for the details.  (:>)

                • 5. Re: Loss of EPo to Agent Communication
                  JoeBidgood

                  Hm, there's almost nothing in there at all Certainly not what I would expect to see from an active agent.

                  In the same folder there should be an agent_<machinename>_backup.log - is there anything useful-looking in there, or does it just contain the same string of messages as the agent log? If there is, can you attach it?

                   

                  Thanks -

                   

                  Joe

                  1 of 1 people found this helpful
                  • 6. Re: Loss of EPo to Agent Communication
                    cg-windstream

                    .Probably because the last successful communication & update was in July 8, 2013!

                     

                    The Agent_VPNACS1-ROC_backup.log has exactly the same listings except for the beginning & end dates.  The McScript_backup.log looks more interesting.  I don't know that any of it is useful but here it is.try

                     

                    I may just try reinstalling the Agent.  What bad thing might occur with that approach?

                    • 7. Re: Loss of EPo to Agent Communication
                      JoeBidgood

                      I would definitely reinstall the agent in this case... there's nothing really in the logs that can help us, so I'd just uninstall and reinstall on this one machine.

                       

                      HTH -

                       

                      Joe