6 Replies Latest reply on Feb 4, 2015 8:30 AM by kamil.wyroslak

    ePO: McAgent online/offline when and why?

    duvd

      Dear all,

      I using ePO 5.1.0 for my system.

       

      I do not see in the ePO configuration setting for McAgent Online/ offline status.

       

      In some testcase of mine, i want to know some reason when McAfee online/offline.

       

      1, when McAfee online/offline?, priority when connecting?

      2, intervals to check the status of McAgent

      3, show me where setting of status interval

       

      Thanks so much.

        • 1. Re: ePO: McAgent online/offline when and why?
          fitchsoccer342

          This is no "online/offline" setting for the McAfee Agent. The McAfee Agent is "online" every second your computer is online and the service is running properly. It will always be enforcing policies for whatever products you have installed, and checking in based on the ASCI you have defined.

           

          Your questions:

          1. when McAfee online/offline?, priority when connecting?

          The Agent is online all the time, as long as FrameworkService.exe is running. I am not sure what you mean by priority when connecting.

           

          2. intervals to check the status of McAgent

          This is based on what you configure for the ASCI (agent-to-server-communication-interval) which is set in the Policy Catalog > McAfee Agent > General policies. See screenshot.

           

          3. show me where setting of status interval

          You can open the McAfee Agent on your computer (Right-click agent in taskbar and choose McAfee Agent Status Monitor) and you will see logs of what the agent is doing, when it checks in, etc. The logs are written to C:\ProgramData\McAfee\Common Framework\DB or you can look in the ePO console, find the machine, and see its last check in time.

          • 2. Re: ePO: McAgent online/offline when and why?
            duvd

            Hi

            The McAfee Agent cycles through the following connection methods six times or until one of a set of

            responses is returned.

            1 IP address

            2 Fully qualified domain name

            3 NetBIOS

             

            I think this is priority when connecting from Agent to Handler

             

            2. intervals to check the status of McAgent

            • 3. Re: ePO: McAgent online/offline when and why?
              Laszlo G

              Hi duvd, a McAfee Agent will set a computer as offline node when it cannot reach the server during the agent-to-server communication interval so if a node cannot reach the AH or ePO through any way (IP; Netbios...) then it automatically changes to offline mode and applies the DLP offline policies

              • 4. Re: ePO: McAgent online/offline when and why?
                duvd

                Hi ulyses31:

                I think that you say, too, How long period of time for agent change status from online to offline. I think this very important to know ePO. I search and read production but its mentioned.

                 

                 

                When a connection from Agent to AH or ePO timeout or connection refused, in three connections method: ip address, dns, netbios name, then Agent try to connect, how long agent offline?

                 

                 

                Some networks topology, i think the condition of timeout happen frequently. Think apprehend two mode is necessary to debug or troubleshoot system.

                 

                 

                Thanks.

                • 5. Re: ePO: McAgent online/offline when and why?
                  duvd

                  Dear all,

                   

                  Help me this question.

                   

                  Thanks.

                  • 6. Re: ePO: McAgent online/offline when and why?
                    kamil.wyroslak

                    Onnline is when yo can resolve your DOMAIN.

                     

                    For example:

                    If your compuer name is COMP.domain.local

                     

                    check in CMD        nslookup domain.local  

                     

                     

                    If you see:

                    Server:  <dnsnameserver>.domain.local

                    Address:  <ipadres>

                     

                    Name:    domain.local

                    Addresses:  <ipadres1>

                              <ipadres2>

                     

                    then you have ONLINE