Query on mfetp.exe

[Remix]

Hi,

I have the exact same issue on a single server (see the EndpointSecurityPlatform_errors.log entry below)

Was McAfee able to pinpoint what the issue is with this?

03/13/2019 03:59:37.779 PM    mfetp(4156.6972) <SYSTEM> exclusion.EXCLUSION.Error (exclusionbl.cpp:5334): Sending exclusion policy to AMCore failed. Task name: EXCLUSION_EXCLUDE_OAS_PROCESS_GROUP_DEFAULT, Error code: 0xA7F40511

03/13/2019 03:59:37.795 PM    mfetp(4156.6972) <SYSTEM> exclusion.EXCLUSION.Error (exclusionbl.cpp:5128): Failed to set property :

03/13/2019 03:59:37.796 PM    mfetp(4156.6972) <SYSTEM> exclusion.EXCLUSION.Error (exclusionbl.cpp:4792): AMCore error code: 0xA7F40511

03/13/2019 03:59:37.798 PM    mfetp(4156.10968) <SYSTEM> MaSpb.MaSpb.Error (lpc_EnforcePolicies.cpp:1449): SetFileExclusion: Failed to set exclusion task settings. TaskName = EXCLUDE_OAS_PROCESS_GROUP_DEFAULT, Error Code = xc0350025

[fattonymaximus]

Hi, 

Advice provided by McAfee was to upgrade February 2019 release ENS 10.6.1.1206 and Threat Prevention 10.6.1.1273 

[mastercam]

Support is suggesting it's an OS issue for us.
Though we are seeing HIGH disk utilization. 

Odd. 

[BN-Rob]

Hello,

since 2 weeks we have the same problem. some clients is mcafee not repsonding. in the error we can see:

05/09/2019 02:03:42.043 PM mfeesp(3848.8256) <SYSTEM> LPC.CommonLPC.Error (common_policy_enforcement.cpp:1865): ENSGlobalExclusion: Error: Delete policy failed with error 87

05/09/2019 02:03:42.082 PM mfeesp(3848.8256) <SYSTEM> LPC.CommonLPC.Error (common_policy_enforcement.cpp:1479): Failed to set policies for telemetry, -2147483391
05/09/2019 02:04:57.251 PM mfetp(3512.4908) <SYSTEM> oasbl.OAS.Error (oasbl.cpp:1626): AVPolicyBeginUpdate(&hUpdate) failed: 0x6be
05/09/2019 02:04:57.254 PM mfetp(3512.4908) <SYSTEM> oasbl.OAS.Error (oasbl.cpp:1820): Failed to refresh AMCore GTI proxy settings
05/09/2019 02:04:57.252 PM mfetp(3512.4896) <SYSTEM> oasbl.OAS.Error (oasbl.cpp:1626): AVPolicyBeginUpdate(&hUpdate) failed: 0x6be
05/09/2019 02:04:57.267 PM mfetp(3512.4896) <SYSTEM> oasbl.OAS.Error (oasbl.cpp:1820): Failed to refresh AMCore GTI proxy settings
05/09/2019 02:04:57.252 PM mfetp(3512.4892) <SYSTEM> oasbl.OAS.Error (oasbl.cpp:1626): AVPolicyBeginUpdate(&hUpdate) failed: 0x6be
05/09/2019 02:04:57.269 PM mfetp(3512.4892) <SYSTEM> oasbl.OAS.Error (oasbl.cpp:1820): Failed to refresh AMCore GTI proxy settings
05/09/2019 02:04:57.252 PM mfetp(3512.4912) <SYSTEM> oasbl.OAS.Error (oasbl.cpp:1626): AVPolicyBeginUpdate(&hUpdate) failed: 0x6be
05/09/2019 02:04:57.252 PM mfetp(3512.4904) <SYSTEM> oasbl.OAS.Error (oasbl.cpp:1626): AVPolicyBeginUpdate(&hUpdate) failed: 0x6be
05/09/2019 02:04:57.270 PM mfetp(3512.4912) <SYSTEM> oasbl.OAS.Error (oasbl.cpp:1820): Failed to refresh AMCore GTI proxy settings
05/09/2019 02:04:57.270 PM mfetp(3512.4904) <SYSTEM> oasbl.OAS.Error (oasbl.cpp:1820): Failed to refresh AMCore GTI proxy settings
05/09/2019 02:04:57.273 PM mfetp(3512.4632) <SYSTEM> oasbl.OAS.Error (oasbl.cpp:2258): StateChangeEventCallback: AVS_INITIALIZE_FAILED or AVS_CRASH or AVS_CORRUPT_CONTENT, state = 0 : calling UpdateWACState(WAC_OAS_DISABLE)
05/09/2019 02:04:57.287 PM mfetp(3512.4912) <SYSTEM> oasbl.OAS.Error (oasbl.cpp:1626): AVPolicyBeginUpdate(&hUpdate) failed: 0x6ef
05/09/2019 02:04:57.288 PM mfetp(3512.4912) <SYSTEM> oasbl.OAS.Error (oasbl.cpp:1820): Failed to refresh AMCore GTI proxy settings
05/09/2019 02:04:57.902 PM mfetp(3512.4896) <SYSTEM> oasbl.OAS.Error (oasbl.cpp:1626): AVPolicyBeginUpdate(&hUpdate) failed: 0x6ef
05/09/2019 02:04:57.902 PM mfetp(3512.4896) <SYSTEM> oasbl.OAS.Error (oasbl.cpp:1820): Failed to refresh AMCore GTI proxy settings
05/09/2019 02:04:57.931 PM mfetp(3512.4904) <SYSTEM> oasbl.OAS.Error (oasbl.cpp:1626): AVPolicyBeginUpdate(&hUpdate) failed: 0x6ef
05/09/2019 02:04:57.932 PM mfetp(3512.4904) <SYSTEM> oasbl.OAS.Error (oasbl.cpp:1820): Failed to refresh AMCore GTI proxy settings
05/09/2019 02:06:37.880 PM McTray(4660.4196) <frickes> McTray.McTrayUPC.Error (TechnologyTopicHandler.cpp:150): CheckTechnologyState failed to get technology status from BO: ATP, error: 80000002L
05/09/2019 02:06:37.881 PM McTray(4660.4196) <frickes> McTray.McTrayUPC.Error (TechnologyTopicHandler.cpp:213): Adaptiver Bedrohungsschutz is not responding.
05/09/2019 02:07:37.947 PM McTray(4660.4196) <frickes> McTray.McTrayUPC.Error (TechnologyTopicHandler.cpp:150): CheckTechnologyState failed to get technology status from BO: ATP, error: 80000002L
05/09/2019 02:07:37.948 PM McTray(4660.4196) <frickes> McTray.McTrayUPC.Error (TechnologyTopicHandler.cpp:213): Adaptiver Bedrohungsschutz is not responding.
05/09/2019 02:08:37.979 PM McTray(4660.4196) <frickes> McTray.McTrayUPC.Error (TechnologyTopicHandler.cpp:150): CheckTechnologyState failed to get technology status from BO: ATP, error: 80000002L
05/09/2019 02:08:37.980 PM McTray(4660.4196) <frickes> McTray.McTrayUPC.Error (TechnologyTopicHandler.cpp:213): Adaptiver Bedrohungsschutz is not responding.
05/09/2019 02:09:38.008 PM McTray(4660.4196) <frickes> McTray.McTrayUPC.Error (TechnologyTopicHandler.cpp:150): CheckTechnologyState failed to get technology status from BO: ATP, error: 80000002L
05/09/2019 02:09:38.009 PM McTray(4660.4196) <frickes> McTray.McTrayUPC.Error (TechnologyTopicHandler.cpp:213): Adaptiver Bedrohungsschutz is not responding.
05/09/2019 02:12:52.843 PM mfeesp(3848.7560) <SYSTEM> LPC.CommonLPC.Error (common_policy_enforcement.cpp:1865): ENSGlobalExclusion: Error: Delete policy failed with error 87

05/09/2019 02:12:52.878 PM mfeesp(3848.7560) <SYSTEM> LPC.CommonLPC.Error (common_policy_enforcement.cpp:1479): Failed to set policies for telemetry, -2147483391
05/09/2019 02:26:08.344 PM mfeesp(3848.8256) <SYSTEM> LPC.CommonLPC.Error (common_prop_collection.cpp:373): RegQueryValueEx for bGlobExclConfigured failed with error: 2

Actual config:

Agent 5.6.0.702
Endpoint Security Platform 10.6.1.1206
Endpoint Security Threat Prevention 10.6.1.1273

On most clients a reinstall helps but on some comes back after 2-3 days again. Have you an idea what can be the problem? We downgrade from Agent 5.6.0.878 to agent 5.6.0.702. But problem exist agian.

Help it to downgrade to last agent version 5.5 or must we downgrade also to platform version 10.5?

We have also not found a ePO query to find out the "bad" systems. We can only react when user is calling us.

regards
Robert

[fattonymaximus]

Hi BN-Bob,

Might be a good idea to check if there is a memory leak on mfept.exe process, as can see the memory is increasing of some devices with ENS 10.6.1.1124 and TP 10.6.1.1208. The advice was to roll out hotifx 190212 which is meant to resolve a memory leak with mfeAtp.exe but devices with the February Hotfix 190212 applied don't seem to have having issues.

If you are using the agent 5.6.0.878 it is best to remove this from your EPO and downgrade any client that has this agent installed.

[fattonymaximus]

What issues are you seeing BN-Bob? Can you see the mfetp.exe process is consuming alot of memory?

[BN-Rob]

Hi,

when we look to taskmanager you can not see any unnormal memory usage or cpu and disk usage.

I have also opened a SR (4-19901180411) but we heard since a week nothing from the support.

The Hotfix is applied on the machines.

[Former Member]

Hi Robert, I have just checked your service request and your case is already raised with our engineering time. Dependant on what needs to be done from our engineering side this can sometimes take longer. Based on the comments that our developers have left after reviewing the data, It would seem that this requires some code changes rather than configuration changes. The assigned technical owner of the case will be in contact with you as soon as there are any further updates from the engineering team.

[fattonymaximus]

Hi BN-Bob

What I am seeing is that the mfetp.exe reaches a certain threshold and then crashes at some point which can be seen in the application logs of the event viewer

[mastercam]

We too ran the Hotfix. The issue occurred but seemed to release within 10-15 seconds.
Then things proceeded normally.

Again, we were told some logs showed it to be an OS issue.
Still odd, because the user can open and close the folders normally when Mcafee is not installed. 

We may re-image or replace the machine rather than continuing to dig, as the user is up for a re-fressh soon.