Unknown failure occurred on property collection (Agent 5.0)

[Former Member]

Systems with McAfee Agent 5.0.0.2620 generate the follwoing error:

Event ID: 2427

Event Type: Property Collection

Error Code: Unknown failure occured on property collection

masvc_xxxxxxx.log:

2014-11-24 08:18:36.226 masvc(1836.1860) property.Info: Property collection session timedout.

2014-11-24 08:18:36.226 masvc(1836.1860) property.Warning: Property collection failure event for SITEADV_3500.

2014-11-24 08:18:36.226 masvc(1836.1860) property.Warning: Property collection failure event for VIRUSCAN8800.

Systems with Agent 4.8 do not generate this error. Does someone know why this is happening?

[gunnars]

Did you ever get an aswer/resolution to this one please?

[Former Member]

We are getting those events with agent 5.0.3.316.

Does anybody know what is the root cause and how to fix it?

[Former Member]

Cause:

This can happen when a point-product plugin is slow to initialize after a service restart. The issue occurs when the agent attempts a policy enforcement or properties collection before a plugin is fully initialized.

Solution:

The event ID is correctly generated by the agent; however, MA 5.0.3 (and later) will be updated to ignore policy enforcement failures or property collection failures at system start so that these events are no longer created.

Refer KB86032 ​for further information.

[andrew_robinson]

Still happening left, right and centre in agent 5.5.1.402...................

[cdinet]

Property collection can fail for a number of reasons.

a corrupt agent db file

dll injection where syscore is blocking due to injection of untrusted processes

agent failure to communicate with point product - could be agent or most likely issue with point product not communicating with the agent

This would require detailed analysis by support, so please open a ticket if you are still experiencing this.

[andrew_robinson]

Agreed. I have had various tickets open with support. They don't tend to find a cause, just a solution (which I typically don't need). Will re-address once we have finally made it to 5.10 and the new agent just out......

[cdinet]

If you have any cases where they couldn't find root cause, let me know the case number please.

[andrew_robinson]

I dare say I have many. They just gave up on 4-19907616531 today.

[cdinet]

Let me check it out