We currenlty experiencing issues with Virusscan not updating clients on about 95% of our machines. We are running Virusscan 8.7i with ePO 4.0 and agent 4.0. Now according to the EOL articles these versions SHOULD not be affected, but they were.
We have tested some and found that if we upgrade the ePO agent to 4.0.1494 the issues is resolved. Or if we delete or rename the V2datdet.mcs file then run autoupdate the update continues.
We currently have level 2 looking at the issue, but wanted to see if anyone here has experienced the issues.
All repo's are up to date with latest files, and replication, ePO services and all other aspects of ePO are working correctly. It looks like it's just an issue on the client side.
Example of log file on affected machine:
4/7/2010 07:07:37 AM CORP\USER Starting task: AutoUpdate
4/7/2010 07:07:38 AM CORP\USER Checking update packages from repository *************.
4/7/2010 07:07:38 AM CORP\USER Initializing update...
4/7/2010 07:07:38 AM CORP\USER Verifying catalog.z.
4/7/2010 07:07:38 AM CORP\USER Extracting catalog.z.
4/7/2010 07:07:38 AM CORP\USER Loading update configuration from: catalog.xml
4/7/2010 07:07:39 AM CORP\USER These updates will be applied if they are in the repository: Engine, DAT, VSCANCEU1000, EXTRADAT1000, BOCVSE__1000, VIRUSCAN8700.
4/7/2010 07:07:39 AM CORP\USER Downloading PkgCatalog.z.
4/7/2010 07:07:39 AM CORP\USER Verifying PkgCatalog.z.
4/7/2010 07:07:39 AM CORP\USER Extracting PkgCatalog.z.
4/7/2010 07:07:39 AM CORP\USER Loading update configuration from: PkgCatalog.xml
4/7/2010 07:07:40 AM CORP\USER Verifying V2engdet.mcs.
4/7/2010 07:07:40 AM CORP\USER Downloading V2engdet.mcs.
4/7/2010 07:07:43 AM CORP\USER Error occurred while downloading C:\ProgramData\McAfee\Common Framework\Current\VSCANENG1000\PkgCatalog.z.
4/7/2010 07:07:43 AM CORP\USER Downloading PkgCatalog.z.
4/7/2010 07:07:43 AM CORP\USER Verifying PkgCatalog.z.
4/7/2010 07:07:43 AM CORP\USER Extracting PkgCatalog.z.
4/7/2010 07:07:43 AM CORP\USER Loading update configuration from: PkgCatalog.xml
4/7/2010 07:07:44 AM CORP\USER Verifying V2datdet.mcs.
4/7/2010 07:07:44 AM CORP\USER Downloading V2datdet.mcs.
4/7/2010 07:07:46 AM CORP\USER Error occurred while downloading C:\ProgramData\McAfee\Common Framework\Current\VSCANDAT1000\PkgCatalog.z.
4/7/2010 07:07:46 AM CORP\USER Verifying DATDet.mcs.
4/7/2010 07:07:46 AM CORP\USER Searching available updates for DATs.
4/7/2010 07:07:46 AM CORP\USER Product(s) running the latest ExtraDAT.
4/7/2010 07:07:46 AM CORP\USER Verifying BocDet_VSE.McS.
4/7/2010 07:07:46 AM CORP\USER Downloading BocDet_VSE.McS.
4/7/2010 07:07:46 AM CORP\USER Searching available updates for BOC DAT.
4/7/2010 07:07:46 AM CORP\USER Downloading PkgCatalog.z.
4/7/2010 07:07:46 AM CORP\USER Verifying PkgCatalog.z.
4/7/2010 07:07:46 AM CORP\USER Extracting PkgCatalog.z.
4/7/2010 07:07:46 AM CORP\USER Loading update configuration from: PkgCatalog.xml
4/7/2010 07:07:47 AM CORP\USER Starting BOC DAT update.
4/7/2010 07:07:47 AM CORP\USER Downloading vscan.bof.
4/7/2010 07:07:48 AM CORP\USER Update succeeded to version 493.
4/7/2010 07:07:48 AM CORP\USER Verifying VSE870Det.McS.
4/7/2010 07:07:48 AM CORP\USER Searching available updates for McAfee VirusScan Enterprise 8.7.0.
4/7/2010 07:07:48 AM CORP\USER Updates were not applied because packages were not in the repository: VSCANCEU1000.
4/7/2010 07:07:49 AM CORP\USER Update Finished
Appreciate any assistance.
Message was edited by: Omnicube on 4/8/10 9:44:30 AM CDTMessage was edited by: Omnicube on 4/8/10 9:55:43 AM CDT
I haven't seen this, but am wondering if it's the installation of 4.0.1494 that resolves the issue, or *just* the re-installation of the EPO Agent that resolves the issue.
If deleting V2datdet/v2engdet.mcs resolves the issue, then potentially second tier support can create a superdat which does just that.You would then be able to deploy via EPO etc.
Is deleting the dat files out of the repository, replicating, and then adding them again (either via a pull or downloading/importing the dat package from http://www.mcafee.com/apps/downloads/security_updates/packages.asp?region=us&segment=enterprise ) a viable option? Might help to convince the clients to download datdet/engdet again. Perhaps try checking in the dat package into an evaluation branch and seeing if some test clients that are assigned to update from Evaluation sort out their files.
Just a thought:
Did you follow the directions in https://kc.mcafee.com/corporate/index?page=content&id=KB60772&pmv=print which instructed us to change to the new V2 sites?
What is the location of the new V2-only CommonUpdater site?
The new V2-only CommonUpdater download site can be accessed via FTP
or HTTP from either:
If so, as I did, I found that the updates stopped working on April 1, 2010. Changing it back to
corrected the updates.
I hope this helps.
Thanks for your replies.
We have tried removing all contents from a repository and deleting the package off of the ePO server. After downloading new packages and replicating a fresh copy, the agents still do not receive the udpates. I have found a few articles pointing at the version number where it was having issues with catalog.z not copying due to size. Also a few reports of the 1421 version having similiar issues to what we are experiencing.
I have tested utilizing the new download source and the old one as well. In both places the files are downloaded and updated in ePO and on the repositories, but the clients still do not see them.
We are still awaiting a response from level 2 support, but i'm starting to think that the agent upgrade is our only choice. I like the idea of a superDAT to delete the file, but we might as well utilize SCCM to push the agent. I have seen where the new agent update does replace the v2datdet.mcs file with a newer version, so i'm assuming McAfee missed the connection with the V2 EOL update and the ePO agent.
All will solved hopefully with help from level 2. I will definitely come back and resond with our findings and solutions.
we have the same Problems with the DAT update.
McAfee Agent in Version 126.96.36.1991 with Vscan Enterprise in Version 8.5.i Patch 8 and ePO 4.0.
Since March 31st there are about 700 from 1200 Client not able to update the latest Pattern.
I look forward to contact the McAfee Support too. Have you got any feedback to your Call ?
Thanks in advanced !!
Thanks all for the replies.
After working with McAfee support and having our ticket go up to tier III support, the conclusion was that hte agent version needed to be upgraded. Apparently the issue lies with a bug in 1421 that keeps updates from downloading from UNC repositories. Their only advice was to update the agents to the latest build. Honestly to me this is not believeable. There is too much coincedience between the March 31st timeframe, EOL on some mcafee products and my agents not updating. But of course they were not going to give out anymore information.
HOWEVER..I was able to determine that if you delete the deldat.mcs file the agent will update, pull down the new version and continue to update. I made McAfee create me a superdat that was pushed out to all clients that deleted this file for me. I set up the SDAT pull about 10 minutes before normal DAT update schedule. After a few days we have about 90% of all 9000 machiens being updated now.
The only action we have left now is to update the agents, but we can now take our time on this as everythign is working almost 100%.
Hope others can use this information to get the issue resolved for them.
just so you think its not a conspiracy....
There is too much coincedience between the March 31st timeframe, EOL on
some mcafee products and my agents not updating. But of course they were
not going to give out anymore information.
It is coincidence.
I discovered that bug months ago and had to upgrade all my clients. I now have http repos.