1 2 3 Previous Next 24 Replies Latest reply on Mar 12, 2008 8:55 AM by Mindcrime

    Event ID: 7036 - KB 614077

      I upgraded from VSE 8.5 patch 1 to patch 4 and my client logs are now loaded with Event ID 7036's from McAfee - "McAfee McShield Service Paused, McAfee McAShield Service has restarted"

      KB 614077
      * The issue was introduced in patch 2 (interesting as there is no patch 2?) and a hotfix was released for: 386922
      * NOTE: This issue will be resolved in the next McAfee VirusScan Enterprise 8.5i Patch release.

      Anyone else getting this? How to resolve? It's clogginng up our event logs which is not good for Servers and is generating some traffic for our service desk.

      Has the issue not been resolved or do I have a setting somewhere that's triggering this?
      Seems to hit every hour for me with 2-4 entries.
      I have Policy enforcement set to 31minutes and Agent Communincation at 120 minutes.
      I'm running VSPLUGIN.dll v8.5.0.895
        • 1. RE: Event ID: 7036 - KB 614077
          We have seen it on all our systems since Patch 1. However, it has not caused any issues in our environment. McAfee Tech support said that it is just a cosmetic issue and would not cause any problems. It is going to be fixed with Patch 5 so we have decided to wait until that patch gets released.
          • 2. RE: Event ID: 7036 - KB 614077
            Not causing any issues here either other than taking up precious Log space on servers where real data can be very important, and generating a low amount of calls from customers who note the activity and think they have issues or viruses. Also tee's off support staff since they have to wade through hundreds of pointless messages to get at the good stuff (about 40-60 entries per day for McAfee Event 7036 here, that's 300 per week, 1,200 per month......)

            Good to hear "Patch 5" will fix it.... since the KB 614077 stated that the "Next Patch" after SP2/3 would fix the issue.
            • 3. Patch 5 doesn't fix it.
              Even though it's mentioned in de readme.txt

              Rolled out patch 5 yesterday, but 2x 7036 Events are still written to the System Event Log at every policy enforcement interval.

              • 4. RE: Patch 5 doesn't fix it.
                We are also having this problem in our environment, but it's causing more than cosmetic issues. I called into support and they told me to switch the VSE language policy settings to "Automatic", previously they were set to English. There was also a hotfix that I checked in and rolled out to no avail.

                I'm very disappointed to hear that patch 5 hasn't fixed this issue as that was going to be the ultimate solution for our problem.

                This issue is causing the McAfee on-access engine to start and stop on a few workstations in our environment, which ultimately bogs the PC down.
                • 5. RE: Event ID: 7036 - KB 614077
                  In my test environment, I can confirm that the Patch 5 has stopped all of those Event ID 7036 messages. Our test environment consists of the following systems:

                  1 x EPO 3.6.1 server, Windows 2003 server.
                  2 x Windows XP SP2 systems
                  1 x Windows Vista Business

                  In the event viewer, all these systems show those messages having stopped after the patch was applied. Not too sure why you are still seeing them.

                  We plan on pushing it out to select system in our real network possibly next week.
                  • 6. RE: Event ID: 7036 - KB 614077

                    Well this is encouraging. I'm curious as to why it didn't resolve the issue for the other poster.
                    • 7. RE: Event ID: 7036 - KB 614077
                      Yes, I am also curious why it did not fix the other persons systems. I confirmed that it stopped the messages before and after rebooting the systems. I do have 2 x Windows 2000 test clients that have never shown these event id messages.
                      • 8. RE: Event ID: 7036 - KB 614077
                        I performed manual local installs on Vista and XP (XP running HIPS 6) and both machines immediately stopped reporting Event ID 7036's. So appears to be working here, which is nice as my Vista test box was continually stopping and starting the service in addition to the log file pollution issue.

                        ePO 3.6.1
                        VSE 8.5 SP4 (upgraded to SP5 for this test)
                        Windows XP & Windows Vista
                        • 9. RE: Event ID: 7036 - KB 614077
                          I did an manual install of patch 5 on an XP SP2 box and it hasnt stopped the 7036 event either.
                          1 2 3 Previous Next