5 Replies Latest reply on Aug 11, 2014 11:26 AM by joe_nismo

    McAfee Agent attempts to download from every repository after agent reinstall

    joe_nismo

      MA 4.8

      ePO 4.6.7

      VSE 8.8

       

      On any given day we have a handful of agents that are not reporting their DAT's into ePO or cannot update their dat due to a current flaw in our image deployment process.  There is a fix for this, but it will take a few months before we can publish a new image for all of our sites.  In the meantime, I fix these by reinstalling the agent and VSE.

      I'm using a 3rd party software deployment tool for the packages.

       

      Scenario 1:

      After the install completes I see some strange repository behavior.  Our policies never have more than one repository enabled, but in the log below you can see it attempting every repository in ePO.  It will do this until it tries every repository and then it will connect to the correct one and update successfully.  We have roughly 150 repositories. so it's a little painful when this happens.

       

      Scenario 2:

       

      I've had agents after install connect to a another repository that is disabled in the agent policy applied to it's subgroup.  This has caused significant WAN saturation.  I run a force wake up and they begin talking to the correct repository.

       

      Scenario 1 log:

       

      8/11/2014, 8:53:29 AM

      Info

      Updater

      Checking update packages from repository 6048.

      8/11/2014, 8:53:29 AM

      Info

      Updater

      Initializing update...

      8/11/2014, 8:53:29 AM

      Info

      Updater

      Downloading catalog.z.

      8/11/2014, 8:53:30 AM

      Info

      Updater

      Verifying catalog.z.

      8/11/2014, 8:53:31 AM

      Info

      Updater

      File catalog.z could not be verified. Downloading complete file again.

      8/11/2014, 8:53:31 AM

      Info

      Updater

      Downloading catalog.z.

      8/11/2014, 8:53:33 AM

      Info

      Updater

      File catalog.z could not be verified. Downloading complete file again.

      8/11/2014, 8:53:33 AM

      Info

      Updater

      Error occurred while verifying catalog.z.

      8/11/2014, 8:53:33 AM

      Info

      Updater

      Update Finished

      8/11/2014, 8:53:34 AM

      Info

      Updater

      Checking update packages from repository 7196.

      8/11/2014, 8:53:34 AM

      Info

      Updater

      Initializing update...

      8/11/2014, 8:53:34 AM

      Info

      Updater

      Downloading catalog.z.

      8/11/2014, 8:53:34 AM

      Info

      Updater

      Verifying catalog.z.

      8/11/2014, 8:53:36 AM

      Info

      Updater

      File catalog.z could not be verified. Downloading complete file again.

      8/11/2014, 8:53:36 AM

      Info

      Updater

      Downloading catalog.z.

      8/11/2014, 8:53:38 AM

      Info

      Updater

      File catalog.z could not be verified. Downloading complete file again.

      8/11/2014, 8:53:38 AM

      Info

      Updater

      Error occurred while verifying catalog.z.

      8/11/2014, 8:53:38 AM

      Info

      Updater

      Update Finished

      8/11/2014, 8:53:39 AM

      Info

      Updater

      Checking update packages from repository 7810.

      8/11/2014, 8:53:39 AM

      Info

      Updater

      Initializing update...

      8/11/2014, 8:53:39 AM

      Info

      Updater

      Downloading catalog.z.

      8/11/2014, 8:53:39 AM

      Info

      Updater

      Verifying catalog.z.

      8/11/2014, 8:53:40 AM

      Info

      Updater

      File catalog.z could not be verified. Downloading complete file again.

      8/11/2014, 8:53:41 AM

      Info

      Updater

      Downloading catalog.z.

      8/11/2014, 8:53:42 AM

      Info

      Agent

      Agent is looking for events to upload

      8/11/2014, 8:53:42 AM

      Info

      Updater

      File catalog.z could not be verified. Downloading complete file again.

      8/11/2014, 8:53:42 AM

      Info

      Updater

      Error occurred while verifying catalog.z.

      8/11/2014, 8:53:42 AM

      Info

      Updater

      Update Finished

      8/11/2014, 8:53:43 AM

      Info

      Updater

      Checking update packages from repository 7227.

      8/11/2014, 8:53:43 AM

      Info

      Updater

      Initializing update...

      8/11/2014, 8:53:43 AM

      Info

      Updater

      Downloading catalog.z.

      8/11/2014, 8:53:43 AM

      Info

      Updater

      Verifying catalog.z.

      8/11/2014, 8:53:44 AM

      Info

      Updater

      File catalog.z could not be verified. Downloading complete file again.

      8/11/2014, 8:53:44 AM

      Info

      Updater

      Downloading catalog.z.

      8/11/2014, 8:53:46 AM

      Info

      Updater

      File catalog.z could not be verified. Downloading complete file again.

      8/11/2014, 8:53:46 AM

      Info

      Updater

      Error occurred while verifying catalog.z.

      8/11/2014, 8:53:46 AM

      Info

      Updater

      Update Finished

      8/11/2014, 8:53:54 AM

      Info

      Updater

      Checking update packages from repository 7257.

      8/11/2014, 8:53:54 AM

      Info

      Updater

      Initializing update...

      8/11/2014, 8:53:54 AM

      Info

      Updater

      Downloading catalog.z.

      8/11/2014, 8:53:57 AM

      Info

      Updater

      Verifying catalog.z.

      8/11/2014, 8:54:00 AM

      Info

      Updater

      File catalog.z could not be verified. Downloading complete file again.

      8/11/2014, 8:54:03 AM

      Info

      Updater

      Downloading catalog.z.

      8/11/2014, 8:54:08 AM

      Info

      Updater

      File catalog.z could not be verified. Downloading complete file again.

      8/11/2014, 8:54:10 AM

      Info

      Updater

      Error occurred while verifying catalog.z.

      8/11/2014, 8:54:10 AM

      Info

      Updater

      Update Finished

      8/11/2014, 8:54:11 AM

      Info

      Updater

      Checking update packages from repository 7120.

      8/11/2014, 8:54:11 AM

      Info

      Updater

      Initializing update...

      8/11/2014, 8:54:11 AM

      Info

      Updater

      Downloading catalog.z.

      8/11/2014, 8:54:12 AM

      Info

      Updater

      Verifying catalog.z.

      8/11/2014, 8:54:13 AM

      Info

      Updater

      File catalog.z could not be verified. Downloading complete file again.

       

      Scenario 2 log:

       

      8/11/2014, 5:19:25 AM

      Info

      Management

      Enforcing Policies for McAfee Agent

      8/11/2014, 5:19:25 AM

      Info

      Agent

      Agent will connect to Server in : 240 minutes and 0 seconds

      8/11/2014, 5:19:48 AM

      Info

      Scheduler

      Next time(local) of task VSE: Daily Update: Monday, August 11, 2014 6:52:00 AM

      8/11/2014, 5:19:48 AM

      Info

      Scheduler

      Added a new task VSE: Daily Update to Scheduler's task list

      8/11/2014, 5:20:03 AM

      Info

      Scheduler

      Next time(local) of task HIPS 8.0: Tuesday, April 03, 2012 4:00:00 AM

      8/11/2014, 5:20:03 AM

      Info

      Scheduler

      Added a new task HIPS 8.0 to Scheduler's task list

      8/11/2014, 5:20:18 AM

      Info

      Scheduler

      Added a new task DLP Agent - Install to Scheduler's task list

      8/11/2014, 5:20:33 AM

      Info

      Scheduler

      Added a new task DLP Agent - Remove to Scheduler's task list

      8/11/2014, 5:20:48 AM

      Info

      Scheduler

      Added a new task HIPS 8.0.0.1919 Remove to Scheduler's task list

      8/11/2014, 5:20:48 AM

      Info

      Scheduler

      Scheduler: Invoking task [DLP Agent - Remove]...

      8/11/2014, 5:20:49 AM

      Info

      Updater

      Checking update packages from repository 7194.   *THIS IS INCORRECT REPOSITORY*

      8/11/2014, 5:20:50 AM

      Info

      Updater

      Initializing update...

      8/11/2014, 5:20:50 AM

      Info

      Updater

      Downloading catalog.z.

      8/11/2014, 5:20:50 AM

      Info

      Updater

      Verifying catalog.z.

      8/11/2014, 5:20:50 AM

      Info

      Updater

      Extracting catalog.z.

      8/11/2014, 5:20:50 AM

      Info

      Updater

      Loading update configuration from: catalog.xml

      8/11/2014, 5:20:51 AM

      Info

      Updater

      Can't get uninstall command from plug-in area.

      8/11/2014, 5:20:51 AM

      Info

      Updater

      Checking for software conflicts.

      8/11/2014, 5:20:51 AM

      Info

      Updater

      Update Finished

      8/11/2014, 5:21:03 AM

      Info

      Scheduler

      The task DLP Agent - Remove is successful

      8/11/2014, 5:21:03 AM

      Info

      Scheduler

      Scheduler: Task [DLP Agent - Remove] is finished

      8/11/2014, 5:21:03 AM

      Info

      Scheduler

      Next time(local) of task Disable Email Scanner: Monday, November 04, 2013 4:00:00 AM

      8/11/2014, 5:21:03 AM

      Info

      Scheduler

      Added a new task Disable Email Scanner to Scheduler's task list

      8/11/2014, 5:21:18 AM

      Info

      Scheduler

      Next time(local) of task VSE: Daily DAT Update: Monday, August 11, 2014 3:07:00 PM

      8/11/2014, 5:21:18 AM

      Info

      Scheduler

      Added a new task VSE: Daily DAT Update to Scheduler's task list

      8/11/2014, 5:21:18 AM

      Info

      Management

      Enforcing Policies for EPOAGENT3000META

      8/11/2014, 5:21:18 AM

      Info

      Management

      Enforcing Policies for EPOAGENT3000

      8/11/2014, 5:21:24 AM

      Info

      Agent

      Agent wakeup call received

      8/11/2014, 5:21:24 AM

      Info

      Agent

      Agent wakeup call for FULL PROPS received

      8/11/2014, 5:21:24 AM

      Info

      Agent

      Agent started performing ASCI

      8/11/2014, 5:21:31 AM

      Info

      Agent

      Agent finished Enforcing policies

      8/11/2014, 5:21:31 AM

      Info

      Agent

      Next policy enforcement in 5 minutes

      8/11/2014, 5:21:31 AM

      Info

      Agent

      Agent Started Enforcing policies

      8/11/2014, 5:21:31 AM

      Info

      Management

      Enforcing Policies for McAfee Agent

      8/11/2014, 5:21:31 AM

      Info

      Management

      Collecting Properties

      8/11/2014, 5:21:31 AM

      Info

      Agent

      Agent is looking for events to upload

      8/11/2014, 5:21:31 AM

      Info

      Management

      Enforcing Policies for EPOAGENT3000META

      8/11/2014, 5:21:31 AM

      Info

      Management

      Enforcing Policies for EPOAGENT3000

      8/11/2014, 5:21:31 AM

      Info

      Agent

      Agent finished Enforcing policies

      8/11/2014, 5:21:31 AM

      Info

      Agent

      Next policy enforcement in 5 minutes

      8/11/2014, 5:21:31 AM

      Info

      Agent

      Agent communication session started

      8/11/2014, 5:21:31 AM

      Info

      Agent

      Agent is sending FULL PROPS package to ePO server

      8/11/2014, 5:21:31 AM

      Info

      Agent

      Agent is connecting to ePO server

      8/11/2014, 5:21:32 AM

      Info

      Agent

      Package uploaded to ePO Server successfully

      8/11/2014, 5:21:32 AM

      Info

      Agent

      Agent communication session closed

      8/11/2014, 5:21:32 AM

      Info

      Agent

      Agent received POLICY package from ePO server

      8/11/2014, 5:21:33 AM

      Info

      Agent

      New server policy was successfully merged

      8/11/2014, 5:21:33 AM

      Info

      Agent

      Enforcing newly downloaded policies

      8/11/2014, 5:21:33 AM

      Info

      Agent

      Agent Started Enforcing policies

      8/11/2014, 5:21:33 AM

      Info

      Management

      Enforcing Policies for McAfee Agent

      8/11/2014, 5:21:33 AM

      Info

      Management

      Enforcing Policies for EPOAGENT3000META

      8/11/2014, 5:21:33 AM

      Info

      Management

      Enforcing Policies for EPOAGENT3000

      8/11/2014, 5:21:33 AM

      Info

      Agent

      Agent finished Enforcing policies

      8/11/2014, 5:21:33 AM

      Info

      Agent

      Next policy enforcement in 5 minutes

      8/11/2014, 5:23:42 AM

      Info

      Updater

      Checking update packages from repository 7285.        *THIS IS THE CORRECT REPOSITORY*

       

      My question is:

       

      What is causing these two scenarios to happen after install?  Why would an agent know to use one of our repositories, but not the correct one?  Is there a way to remove wherever it is getting the repository list from?  It seems that after a wake up call, these issues go away.  I'd like to prevent any updating until it gets the correct current policy from ePO server.