Orion.log spamming "Product ID not found for analyzer"

[jmcg]

Hello,

My Orion.log is spamming :

2019-12-13 10:29:13,120 WARN  [core-CommandInvoker-thread-174] threats.ResolvedThreatsAction  - Product ID not found for analyzer: ABE1073E-C616-4D

2019-12-13 10:29:13,151 WARN  [core-CommandInvoker-thread-177] threats.ResolvedThreatsAction  - Product ID not found for analyzer: ABE1073E-C616-4D

2019-12-13 10:29:13,167 WARN  [core-CommandInvoker-thread-185] threats.ResolvedThreatsAction  - Product ID not found for analyzer: ABE1073E-C616-4D

2019-12-13 10:29:13,167 WARN  [core-CommandInvoker-thread-179] threats.ResolvedThreatsAction  - Product ID not found for analyzer: ABE1073E-C616-4D

I guess this come from a rule in exploit prevention or ATP but not sure.

[LKS]

Hi jmcg,

To be honest not sure what is is. May be it is pointing to some extension corruption or file corruption. 

The below error is alarming to ENSTP product. Do you see any other error in Orion. 

Product ID not found for analyzer

* Check if all ENS policies are accessible.

* Did you recently make any changes in EPO.

* When did you notice this issue.

Was my reply helpful?

If you find this post useful, please give it a Kudos! Also, please don't forget to select "Accept as a Solution" if this reply resolves your query!

[jmcg]

I don't know if that help but I have some others details before

2019-12-13 11:13:09,509 WARN  [core-CommandInvoker-thread-182] services.ComponentService  - Waiting for task entry id 17782642 to be at the top of the queue.
2019-12-13 11:13:10,524 WARN  [core-CommandInvoker-thread-182] services.ComponentService  - Waiting for task entry id 17782642 to be at the top of the queue.
2019-12-13 11:13:11,118 WARN  [core-CommandInvoker-thread-185] autoupdate.AutoUpdateCommand  - a command of type com.mcafee.EPOAGENTMETA.autoupdate.AutoUpdateCommand should have its displayNameKey property set
2019-12-13 11:13:11,540 WARN  [core-CommandInvoker-thread-182] services.ComponentService  - Waiting for task entry id 17782642 to be at the top of the queue.
2019-12-13 11:13:35,368 WARN  [core-CommandInvoker-thread-185] autoupdate.AutoUpdateCommand  - a command of type com.mcafee.EPOAGENTMETA.autoupdate.AutoUpdateCommand should have its displayNameKey property set
2019-12-13 11:15:39,449 WARN  [http-nio-8081-exec-88] internal.LdapServerServiceImpl  - No preferred registered server for domain= eu.com
2019-12-13 11:17:11,512 WARN  [scheduler-InternalTask-thread-10] service.TelemetryDataService  - SQL Exception occured while fetching the details of the CU installed 
2019-12-13 11:24:32,294 WARN  [core-CommandInvoker-thread-182] threats.ResolvedThreatsAction  - Product ID not found for analyzer: ABE1073E-C616-4D
2019-12-13 11:24:32,560 WARN  [core-CommandInvoker-thread-182] threats.ResolvedThreatsAction  - Product ID not found for analyzer: ABE1073E-C616-4D

[jmcg · Accepted solution]

Ok, found it.

Linked to the automatic response named: "Protection Workspace - Master Threat Summary Rule"

So I have disable it for the moment.

[LKS]

Is it fixed now. If not we would require complete Orion log with debug enable to see what's going on. The given logs also does not give much information as it is a generic message. You can log a SR incase if you required more assistance. 

[jmcg]

We are not using Protection Workspace, so we have keep it disabled it for now.