ePO 5.10 CU6 Flood TCP connection between SQL and ePO

[jmcg]

Hello,

After an update from 5.9.1 to ePO 5.10 CU6

We have a Flood of TCP connection between SQL and ePO causing ePO and SQL to crash.

SQL  maximum connections reached

Do you have any idea ? 

We already have created a SR but it's taking to long now.

[cdinet]

There are several extensions that can cause that.  What version extensions are you running (if you are running them) of the following extensions?

mdcc, mcafee agent smart scheduler, support center, cloud workload security (cws), mcafee agent.

You can also get data from kb92272 - that will show us the source.  Particularly this....

Capture SQL Query results in a readable format

To capture the output in a readable format:

1. Log on to SQL Server Management Studio.
2. Right-click the McAfee ePO server and select New Query.
3. Paste the SQL query below into the query window.
   
   SELECT DEST.TEXT,
          COUNT(distinct SDEC.[most_recent_session_id])
   FROM sys.[dm_exec_connections] SDEC
                 CROSS APPLY sys.[dm_exec_sql_text](SDEC.[most_recent_sql_handle]) AS DEST
   GROUP BY Dest.Text
   ORDER BY 2 desc
    
4. Above the toolbar, click the Query menu item.
5. Click Results To, Results to File, or use the shortcut Ctrl+Shift+F.
6. Click Execute on the toolbar, or press F5.
7. To save the output, select a location and leave the Save As Type field as the default, Report files (*.rpt)
8. To revert the output to the default, click Query, Results to, Results to Grid. Or, use the shortcut Ctrl+D.

[jmcg]

Hello,

Thanks you for your reply.

We have already collected the data for our open case.
I will send you the SR number if you want to check.

[cdinet]

From the data gathered, it appears to be from the internal ens firewall property translator task.  Do you have adaptive mode enabled on the firewall for any clients?

[jmcg]

Yes we do

No sorry, the firewall of ENS is disable I have miss check the policy

[cdinet]

Ok, but there is still an internal task that runs.  I would suggest installing the Feb release for 10.7 ens extensions to see if that resolves.  You don't have to upgrade clients.  There was an issue fixed regarding that task and this is listed in release notes.  

McAfee® Endpoint Security Firewall adaptive rule aggregator now retrieves valid
results.

There could be other related fixes for it that are not listed, as only externally reported fixes are in release notes.

[jmcg]

We have already the last Extension of ENS Firewall installed.
version : 10.7.0.459

[jmcg]

The server task firewall property translator had never been "run" by the ePO system

[cdinet]

You wouldn't know that - it is an internal task and has nothing to do with the scheduled or disabled tasks in the epo console under server tasks.  

That analysis was from another advanced team member.  I am a little inclined to it possibly being the agent extension, but the queries running don't match that either.  You do have the support center extension that has the issue and you do have the agent extension version that also has that problem.  We are still looking into this.

[jmcg]

We have removed support center extension and updated to the last version the McAfee Agent Extension to test.

Issue still here.