McAfee Agent 5.6.5.236 - Event ID 2402 "Deployment/Update Successful"

[ezim]

Since updating to MA 5.6.5.236 we are seeing Event ID 2402 "Deployment/Update Successful" in the "Client Events" logs of our machines

The 2402 events are "2402: Update Failed (High)".

Does anybody else see that?
Does anybody know what causes these spurious looking entries?

Event ID: 2402
Severity: Critical
Event Received Time: 11/09/20 00:17:18 BST
Event Generated Time: 11/09/20 00:15:56 BST
Host Name: xxxxxxx
User Name:
IP address: x.x.x.x
Version:
SP HotFix:
Extra DAT Names:
Event Type: Update
Error Code: Deployment/Update Successful
Locale: en
Site Name: ePO_EPO01
Initiator ID: EPOAGENT3000
Initiator Type: UpdateTask
Product Name: McAfee Agent

Event ID: 2401
Severity: Informational
Event Received Time: 10/09/20 23:42:19 BST
Event Generated Time: 10/09/20 23:14:45 BST
Host Name: xxxxxxx
User Name:
IP address: x.x.x.x
Version: 4192.0
SP HotFix:
Extra DAT Names:
Event Type: AMCore
Error Code: Deployment/Update Successful
Locale: en
Site Name: ePO_EPO01
Initiator ID: EPOAGENT3000
Initiator Type: UpdateTask
Product Name: AMCORDAT2000

[Hem]

If you have event ID checked in Event filtering (configuration->server settings->Event filtering) then event will be generated and will be displayed. If don't want then please uncheck event ID from event filter.

[ezim]

I do want to see the 2402 events as they show failures.

The "Error Code" however says "Deployment/Update Successful".

This has started happening since installing the McAfee Agent 5.6.5.236

[Hem]

then you can uncheck 2402 from event filtering.

[ezim]

Hello @Hem ,

I'm sorry, but you are missing what I am saying.

I'll try to explain again. The Event ID 2402 is for failed events.
For example alerting us to issues where the machine is not able to access a repository.

An "Error Code" that I would expect to see is for example: "Unable to find valid repository" which is a failure.

However, since updating the Agent we receive frequent 2402 Events displaying "Deployment/Update Successful". Which looks like a mismatch between Event ID and Error Code.

[cdinet]

I agree, that looks like a mismatch in event type.  Please open a ticket and try to get a mer from a client returning that event that would have logs for the same time frame.  We need to know exactly what happened with the task.  Also an export of the event details would be very helpful to match with the task run time.

[ezim · Accepted solution]

Hello @cdinet,

I've dug a bit deeper on a machine at the time the events occur.

It is the following update task:
#7304 ScrptMain START [C:\Program Files\McAfee\Agent\x86\McScript_InUse.exe -script C:\ProgramData\McAfee\Agent\update\UpdateMain.McS -id 31015 -localeid 0409 -logfile C:\ProgramData\McAfee\Agent\logs\McScript -parent FRAMEWORK -initiator 1 -installdir C:\Program Files\McAfee\Agent\\x86\ -taskid ma.cert.update.task.id]

It turns out the we didn't have the matching "MsgBus Cert Updater package" signed in to the repository the machine was using for its update.

This is described here: KB85552 "ma.cert.update.task fails nightly at 00:00 local system time on endpoints running McAfee Agent 5.0.1 and later".

I've signed this in now and will be checking what results get reported tonight.

So, I'm guessing what we see reported is that the update task has run. It was triggered and ran successfully. But the task's result is a failure, because it couldn't update the "MsgBus Certificate".

[cdinet]

In that log when the cert updater task runs, does it say the task failed or was successful?  If failed, that would explain it.  You can also compare the events you are seeing with that time frame.  If the time frames don't match, then you need to compare it to what tasks are running the time the event occurred, then check the logs for that same time frame.

[ezim]

It is at the time when the event is generated and says:

2020-09-14 00:08:03 I #7304 ScrptMgr These updates will be applied if they are in the repository: EPOAGENT5000META.
2020-09-14 00:08:03 I #7304 ScrptMgr Updates were not applied because the detection scripts were not found in the Evaluation branch: EPOAGENT5000META.

The EPOAGENT5000META directory, is associated with the MA MsgBus Cert Updater package (according to another KB).

[cdinet]

Ok, that makes sense.  The task itself would be successful as far as running the task and reaching the repositories, just not finding the package in right branch.  Issue should go away once you have package in current branch and change policy to point to current branch, or put package in branch it is expecting it in from the agent policy.