ExploitPrevention_activity.log and EndpointSecurityPlatform_Erros.log | Failed | BlockEnabled error

[RaymondP]

Hi,

Every 5 minutes the EndpointSecurityPlatform_Errors.log shows me:

07/17/2019 10:21:53.592 AM mfeesp(4600.3484) LPC.CommonLPC.Error (common_policy_enforcement.cpp:1865): ENSGlobalExclusion: Error: Delete policy failed with error 87

07/17/2019 10:21:53.670 AM mfeesp(4600.3484) LPC.CommonLPC.Error (common_policy_enforcement.cpp:1479): Failed to set policies for telemetry, -2147483391
07/17/2019 10:21:59.701 AM mfetp(5172.5708) TmpLogger.BoBl.Error (BoBl.cpp:1493): Failed to set property: BlockEnabled error: 0x26
07/17/2019 10:22:00.154 AM mfetp(5172.2420) MaSpb.MaSpb.Error (lpc_EnforceBOPolicies.cpp:490): Failed to set Exploit Prevention properties.
07/17/2019 10:22:00.154 AM mfetp(5172.2420) MaSpb.MaSpb.Error (lpc_EnforcePolicies.cpp:2255): Failed to enforce some of the Exploit Prevention policies.

In the ExploitPrevention_Activity.log:

7/17/2019 10:16:59 AM mfetp(5172.5556) TmpLogger.BoBl.Activity: Failed to set property: BlockEnabled error: 0x26
7/17/2019 10:21:59 AM mfetp(5172.5708) TmpLogger.BoBl.Activity: Failed to set property: BlockEnabled error: 0x26
7/17/2019 10:26:59 AM mfetp(5172.5556) TmpLogger.BoBl.Activity: Failed to set property: BlockEnabled error: 0x26

OS is Windows Server 2012R2

Installed McAfee products:

Product	Version
McAfee DXL Client	4.1.0.184
Agent	5.5.0.447
Endpoint Security Firewall	10.6.1.1278
Endpoint Security Platform	10.6.1.1449
Endpoint Security Threat Prevention	10.6.1.1550
Endpoint Security Adaptive Threat Protection	10.6.1.1311

Someone recognized this?

Regards,

Ray

[patrakshar]

@RaymondP  EndpointSecurityPlatform_Errors.log is specifically needed to check if there is any issue functional issue you are seeing. This log contains various API's errors details which helps engineering in debugging some specific issue. Unless you have any functional problem you not really needed to look at the platform error logs. Let me know if there is any specific problem you are seeing from ENS functionality point.

[finkemch]

we do have the same problem on ENS 10.6.1 May Release

Platform Log:
***********
11/18/2019 02:36:21.595 PM McTray(12388.11632) <xxxx> McTray.McTrayUPC.Error (TechnologyTopicHandler.cpp:213): Exploit Prevention is not responding.
11/18/2019 02:36:21.630 PM McTray(12388.11632) <xxxx> McTray.McTrayUPC.Error (TechnologyTopicHandler.cpp:213): On-Access Scan is not responding.
11/18/2019 02:36:21.643 PM McTray(12388.11632) <xxxx> McTray.McTrayUPC.Error (TechnologyTopicHandler.cpp:213): Self Protection is not responding.
11/18/2019 02:36:21.661 PM McTray(12388.11632) <xxxx> McTray.McTrayUPC.Error (TechnologyTopicHandler.cpp:213): ScriptScan is not responding.
11/18/2019 02:36:31.711 PM McTray(12388.12800) <xxxx> McTray.McTrayUPC.Error (TechnologyTopicHandler.cpp:213): AMSI is not responding.
11/18/2019 02:36:32.218 PM McTray(12388.12800) <xxxx> McTray.McTrayUPC.Error (TechnologyTopicHandler.cpp:213): Exploit Prevention is not responding.
11/18/2019 02:36:32.278 PM McTray(12388.12800) <xxxx> McTray.McTrayUPC.Error (TechnologyTopicHandler.cpp:213): On-Access Scan is not responding.
11/18/2019 02:36:32.401 PM McTray(12388.12800) <xxxx> McTray.McTrayUPC.Error (TechnologyTopicHandler.cpp:213): ScriptScan is not responding.
11/18/2019 02:36:41.246 PM McTray(12388.12576) <xxxx> McTray.McTrayUPC.Error (TechnologyTopicHandler.cpp:213): ScriptScan is not responding.
11/18/2019 02:39:21.534 PM McTray(12388.2500) <xxxx> McTray.McTrayUPC.Error (TechnologyTopicHandler.cpp:213): AMSI is not responding.
11/18/2019 02:39:21.557 PM McTray(12388.2500) <xxxx> McTray.McTrayUPC.Error (TechnologyTopicHandler.cpp:213): Adaptive Threat Protection is not responding.

Exploit Prevetion Log:
*****************
11/18/2019 02:14:03.846 PM mfetp(9084.12936) <SYSTEM> MaSpb.MaSpb.Error (lpc_EnforcePolicies.cpp:2255): Failed to enforce some of the Exploit Prevention policies.
11/18/2019 02:14:43.719 PM mfetp(9084.13036) <SYSTEM> MaSpb.MaSpb.Error (lpc_EnforcePolicies.cpp:2255): Failed to enforce some of the Exploit Prevention policies.
11/18/2019 02:15:01.655 PM mfetp(9084.12936) <SYSTEM> MaSpb.MaSpb.Error (lpc_EnforcePolicies.cpp:2255): Failed to enforce some of the Exploit Prevention policies.

[patrakshar]

@finkemch 

Thank you for your post here. May I know the exact functionality wise issue you are facing? As I stated before, the error logs will never be empty. We have various internal components that will write some failure information within that log but that does not mean there will be a functionality issue. We look at this log when we need to correlate some functionality issue with one of the component of ENS. 

[finkemch]

the System has had massive performance problems - to open an Explorer takes a very long time - with uninstalling it was OK again - something has been wrong here - if no Policies could be enforced - it could be the reason for the slowness but why it has Problems ?

[AdithyanT]

Hi @finkemch,

Thank you for your response. I would like to clarify few things before we investigate further.

By performance Issues, Are you referring to the time consumed by your machine to launch Explorer windows or was it accompanied by High CPU or memory usage as well?

Your issue seems to be very close to a recent issue that I came across and hence wanted to ensure this detail. Any specific change you recall happening for this machine? How many endpoints are affected?

When you said after Uninstallation it was Okay again, May I know if the exact issue repeats itself after reinstalling McAfee ENS?

[patrakshar]

It is possible. If a policy getting enforce or not can be validated on the local machine. If you are sure that policies are not coming then we would need to definitely look at the complete policy enforcement flow and see where the problem is. 

As @AdithyanT  mentioned, what is the exact performance issue we are looking at? Are you seeing high CPU/Memory/Disk utilization by McAfee process or overall machine performance has been degraded?

If you verify the local console of the ENS and make sure that exclusions are present which you enforced from EPO, then we can just look at the performance point of view. 

[finkemch]

 The user has had Problems when he opens the Explorer - It takes very long to get the Content displayed

not really high cpu - but a strong delay of the usage of explorer

[AdithyanT]

Hi @finkemch,

Thank you for the update. Weird one, I am sure you see a much faster access to Explorer.exe when you disable on-Access Scanner? Can you kindly confirm that please? Also What happens when you stop the Cryptographic Services and launch explorer.exe immediately with On Access Scanner enabled? This should be done as quick as possible as Cryptographic Services start backup instantaneously once killed.

I think I know what may be the issue.

*Note: This is only for troubleshooting purpose, kindly perform with precaution. ENS has dependency on Cryptographic Service.