How to update Linux Threat Prevention DAT files through ePO?

[cdinet]

That is a local ENS task rather than an agent scheduled task.  You might need to get with the ENS team for troubleshooting that.  Have you tried running an epo scheduled task?

[redwhite123]

I think the issue is there is a DAT file specifically for Linux clients that I would need to check in to ePO. I found it here:

http://update.nai.com/products/commonupdater/current/med_dat_1000/dat/0000/

When I download the zip file and attempt to check in to ePO it errors out saying a missing pkgcatalog.z file which is also on that same download page. Are there directions on how to check this in to ePO?

As of right now I have to manually update the DAT on each Linux machine:

https://kc.mcafee.com/corporate/index?page=content&id=KB88234

[cdinet]

The epo master repository pull task should be pulling them in.  To download them manually to check into epo, you would get them from here - https://www.mcafee.com/enterprise/en-us/downloads/security-updates.html

The DAT Package For Use with McAfee ePO is what you would use to check in.  I know it says Windows, but the non-windows ens/vse uses same dat package.

So if the dats are in the repository and the Linux agent is not updating the system, then I would suggest open a ticket with McAfee so we can look at logs for you.

[redwhite123]

Yep I checked in both of those and still doesn't work. From this post (https://community.mcafee.com/t5/Mac-and-Linux-Products/MEDDAT-pulled-into-ePO-repository/td-p/657018) it sounds like I need the MEDDAT file for Linux clients. There has to be an ePO compatible MEDDAT file somewhere. I did open a ticket and they are saying I need the MEDDAT file but I stated that the ePO server is in a standalone room so no internet access. Just waiting for their reply.  

[LKS]

Hi redwhite123,

MEDDAT is required for ENS 10.7 for Linux and MAC. Am trying to check in the Meddat zip file which i downloaded from the below location am getting the same error "Package missing required pkgcatalog.z file".

http://update.nai.com/Products/CommonUpdater/Current/MED_DAT_1000/DAT/0000

I will check internally and update you.

[redwhite123]

Thank you!

[cdinet]

Here are a couple of different options you can do if ePO server is in a standalone room.  It would require opening firewall to the other source repository location from epo to the repo site.

1.  Follow KB82581 to use another epo server as a source repository for epo to pull the dats from.  That would contain all your required meddats as well as any other content updates needed.

2.  Set up a system that does have internet access with a mirror task - KB92427.  That would apply also to dats.  Use then that mirror location as source repository for epo to pull from

With both of those options, you would then be able to use epo as a repository for the clients to update from.

[LKS]

There is a workaround to check in MEDDAT file in to EPO MR. Follow the below steps, 

1. Create a new Folder.
2. Download “datdet.mcs”    file from “http://update.nai.com/products/commonupdater/current/med_dat_1000/ “ location an copy to the folder
3. From http://update.nai.com/products/commonupdater/current/med_dat_1000/dat/0000/ location download last 35 Gem Files, extradat.mcs, meddatinstall.mcs, gdeltamed.ini, mediumdat-xxxx.zip, pkgcatalog.zip files.

4. Make a ZIP of all these files and you can check in into EPO master repository for deployment.

Was my reply helpful?

If you find this post useful, please give it a Kudos! Also, please don't forget to select "Accept as a Solution" if this reply resolves your query!

[redwhite123]

I'm getting this error message when attempting to check in:

Unknown failure processing package

I've attached a screenshot of the zip file contents I created, I'm not sure if anything is missing.

[cdinet]

Remove the replica.log and see if that helps.