Endpoint Protection deployment failing on OS x devices

[pwidhalm]

We are experiencing failures to deploy Endpoint Security Threat Protection to all Mac devices. The error we are receiving is: Details: Product "ENDP_AM_1055MACX" installation failed, reason "Unknown error".. Mac Agent on devices is 5.5.1.342 OS X version 10.13 Product attempting to deploy: Endpoint Security Threat Prevention for Mac 10.5.5.150 Have tried to create a new task to deploy, have used the Deployment Project to create new task.

[pwidhalm]

Information from Log file on client:

2018-09-28 09:16:35.458 (80.-1443867840) ahclient.Info: Agent communication session started
2018-09-28 09:16:35.458 (80.-1443867840) ahclient.Info: Agent is connecting to ePO server
2018-09-28 09:16:35.458 (80.-1443867840) ahclient.Info: Initiating spipe connection to site https://IP ADDRESS OF EPO SERVER:443/spipe/pkg?AgentGuid={xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}&Source=Agent_3.0.0.
2018-09-28 09:16:35.463 (80.-1443867840) ahclient.Info: connection initiated  to site https://IP ADDRESS OF EPO SERVER:443/spipe/pkg?AgentGuid={xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}&Source=Agent_3.0.0.
2018-09-28 09:16:35.526 (80.-1443867840) crypto.Info: Negotiated Cipher : EDH-RSA-AES256-SHA256
2018-09-28 09:16:35.592 (80.-1443867840) ahclient.Info: Network library rc = <1008>, Agent handler reports response code <202>.
2018-09-28 09:16:35.593 (80.-1443867840) ahclient.Info: Agent handler doesn't have anything to send. response code 202.
2018-09-28 09:16:35.593 (80.-1443867840) ahclient.Info: Spipe connection response received, network return code = 1008, response code 202.
2018-09-28 09:16:35.593 (80.-1443867840) DataChannel.Manager.Info: Package uploaded to ePO Server successfully
2018-09-28 09:16:35.595 (80.-1443867840) ahclient.Info: Agent communication session closed
2018-09-28 09:16:35.595 (80.-1443867840) ioservice.Info: IO service received the message.
2018-09-28 09:16:35.595 (80.-1443867840) ioservice.Info: IO service received the message.
2018-09-28 09:16:36.453 (80.-1443867840) scheduler.Info: The task  McAfee Agent >  Product Deployment has failed
2018-09-28 09:16:36.458 (80.-1443867840) scheduler.Info: Scheduler: Task [McAfee Agent >  Product Deployment] is finished
2018-09-28 09:16:36.460 (80.-1443867840) scheduler.Info: The task McAfee Agent >  Product Deployment is freed
2018-09-28 09:16:41.968 (80.-1443867840) scheduler.Info: The task ma.property.collect.if.delay.by.days.task.name is still running
2018-09-28 09:16:41.969 (80.-1443867840) scheduler.Info: The status of the task ma.property.collect.if.delay.by.days.task.name  is unknown
2018-09-28 09:17:41.997 (80.-1443867840) scheduler.Info: The task ma.property.collect.if.delay.by.days.task.name has been stopped by Scheduler
2018-09-28 09:17:42.004 (80.-1443867840) scheduler.Info: Scheduler: Task [ma.property.collect.if.delay.by.days.task.name] is finished
2018-09-28 09:17:42.005 (80.-1443867840) scheduler.Info: The task ma.property.collect.if.delay.by.days.task.name is freed

[cdinet]

Check the mcscript deploy logs on the client. That should show you info on whether it can get the packages to install or not, or if it failed after getting the files and invoking the installer.

[pwidhalm]

CDINet, thank you for your response.  The information provided above is from the agent_monitor.log file on the Mac OS X device.  I cannot find an mcscript.log on a Mac, can find on a PC though.  

That siad, the information I posted above is the only info I can find unless I am missing the correct name of a log file to look for.  Any other suggestions are appreciated.

Thanks - Pat

[cdinet]

The agent logs on a mac are located under /var/McAfee/agent/logs.

[pwidhalm · Accepted solution]

cdinet,  thanks for pointing to the logs.

The only thing I found in the logs was a reference to a "failure to set the working directory.   While looking for errors associated with this, we removed all Mac products from the Master repository, then re-added the Mac Agent and the Endpoint Security products.  This resulted in the same failure.

then applied the Hotifix for agent 5.5.1.374, which says is for compatiblity with OS X 10.14.  However after installing this Hotfix, am able to apply updates to Endpoint Security on OS X 10.13.