HIPS not working after ePO upgrade from 5.1.0 to 5.1.3

[boschind]

yeterday i did the upgrade of ePO from 5.1.0 to 5.13 - the setup went smootly but in ePO console HIPS dashboards are not working anymore.

[boschind]

when i start login ePO console web page the following msg is displayed:

HostIpsAdv - Dependent plugin hip8 failed with initialization error

HostIPSLicense - Dependent plugin hip8 failed with initialization error

hip8 - Error creating bean with name 'hip8.command.registration': Unsatisfied dependency expressed through bean property 'commandInvoker': : Error creating bean with name 'hip8.actions.FWClientRuleActions' defined in URL [jndi:/localhost/HOSTIPS_8000/WEB-INF/beans.xml]: Instantiation of bean failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.aop.framework.ProxyFactoryBean]: Constructor threw exception; nested exception is java.lang.NoSuchMethodError: org.springframework.core.CollectionFactory.createIdentityMapIfPossible(I)Ljava/util/Map;; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'hip8.actions.FWClientRuleActions' defined in URL [jndi:/localhost/HOSTIPS_8000/WEB-INF/beans.xml]: Instantiation of bean failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.aop.framework.ProxyFactoryBean]: Constructor threw exception; nested exception is java.lang.NoSuchMethodError: org.springframework.core.CollectionFactory.createIdentityMapIfPossible(I)Ljava/util/Map;

btw i can access the console, see all dashboards except those about  HIPS - HIPS monitors and queries shows:

This query cannot be displayed because it is in an invalid state. View the query's details for more information.

any help or suggestion

thanks in advance

[andrep1]

Unless you have a good backup to revert back to

1. take a backup of epo folder and epo db

2. stop master repository pull task

3. remove hips extension

4. reinstall hips extension (maybe try extension for HIPS 8 patch 7 if it is out already)

You'll pretty much loose all you hips stuff, policies, etc... If your HIPS policies are exportable in your server's current state, then do that also.

[boschind]

thanks Andre for your answer and suggestions. would you be so kind to give some more details on the steps to recover this issue?

you know it because you had paste experiences? i'm let's say disappointed by the fact the the setup process ran smootly ,and most of the ePO is up and running but this damn extension is giving me this problem....

thanks again

[andrep1]

Extensions will fail and it a fact of life, it has happened to me many times...

In extensions, click remove to remove the hips 8 extensions, then they can be reinstalled. Download the latest extension from mcafee or from the software manager in ePO.

Then go to extension and check them in.  Ideally do that when the server is not too busy  (at night), ensure a backup of you db has been taken and make a copy of the ePolicy Orchestrator folder on your epo server.

[boschind]

the fact that it is "normal" to have problem with extensions is only a "cold confort".... but thanks for sharing your experience.

another question before starting removing HIPS extensions: via epo console i still have access to the policy catalog and i can still select:

HIPS 8.0:General

HIPS 8.0:Firewall

HIPS 8.0:IPS

and i can select the export button to save them as xml files

after the extensions removal and reinstall should i import them to restore HIPS policies?

extensions removal order is

license

advance

HIPS 8.0.0

isn't it?

thanks

[andrep1 · Accepted solution]

Export all you can, they might be reusable. Just no guarantee.

Problem is sometimes a policy can be corrupt, you just wont know. But then you realize the console password hasn't changed, or a feature is note enabled. So after importing a policy, you have to do a good sanity check on the endpoint to verify everything is working.

As far as order, ePO  will tell you if here is a dependency.

Andre

[boschind]

i feel as a lucky guy ... for your support and because , before attempting to remove failing HIPS extensions (ver 8.0.6.978) and since there are available new ver 8.0.7.1001 , i attempted to upgrade to this new version the old failing ones. bingo! it worked !

here are a couple of screenshots

during the upgrade

after the upgrade

now i'm reviewing policies , queries , etc..

but it seems that it works

THANKS

[Former Member]

This is a known issue:

(ePolicy Orchestrator 5.1.x Known Issues) Technical Articles ID: KB80075 It is the 1st issue listed.

During upgrade to ePO 5.1.3, all permissions related to Host Intrusion Prevention (Host IPS) for the existing permission sets are lost. Host IPS settings are reset to No Permission for the existing permission sets, but other permissions are saved with existing settings.  You will need to back up the HOST IPS permission sets before the update to ePO 5.1.3 and then restore the permissions sets after the upgrade.

Here is the related KB if you have any questions  KB85912.

[boschind]

thanks