ewong

Oh, the agent's log. Was looking at the server one. But re: server's trace.log, I've taken a look at the permissions and am not sure what the default. I took a look at the permissions of other files and they're the same. I'm thinking of deleting that file and hope it'll get regenerated. Thanks!

I was logged in to ESMC this morning and when to went and worked on something else, I noticed the system had booted me off from the ESMC and had returned to the log in screen. I tried to login but got "Login failed: Connection has failed with state 'Not connected'. I went to the server log and looked through what was wrong only to discover that the last entry in the c:\Programdata\ESET\RemoteAdministrator\Server\EraServerApplicationData\Logs\trace.log was dated last year. In the same directory, there's a ConsoleApi that's dated today [13 July 2020]. I checked the disk space and I have ample, so I'm confused as to how the product was updated to the latest version without logging to the trace.log file. Question: What situation would lead to the server not update the trace.log? That said, the upgrade task failed as it couldn't get the webconsole file from the repository. Went to the repo and realized that the file was indeed missing. [probably stemmed from my issue with mirrortool.]. So at the end, I manually updated the webconsole, and things seem to be running ok. Edmund

After running ESMC on a server for a bit, I migrated it off to using MySQL instead of the built in SQL Server (Express?). Does the RSMC still use the SQL server?

I've been having some difficulties getting MirrorTool to run consistently in the past and now,it's failing everytime I run in. What I'd get is the following: Also, it stops at "Downloading file: update.ver. Downloaded: 100 %" for a long time (10 - 20 min. [currently timing the current run]) before proceeding. Can someone clarify what 8451 error code is? Furthermore, is it possible in the future to have a better verbose option or a log-to-file option? Thanks! Edmund

Recently, I've been alerted to systems not connecting to the ESMC server. I logged on and noticed that all machines weren't connecting. I looked at one workstation's status.html and saw the following: I'm seeing the same error in the trace.log. [Another issue is the updates reporting an error: "Update information is not consistent" but I'm thinking this might just be because updates via mirrortool has been inconsistent. Network hiccups or something of the like. Not sure. Right now, I'm running the MirrorTool to update the updates repo; but it's slow as heck. ] I'm getting the feeling that something 'bad' is going on in the network; but at this moment, I can't pinpoint out what's bugging it. Might anyone have any idea what might be the problem? Thanks Edmund

Do you have the part of the logs that show the process of connection?

In my experience with Pre-6.5 agents on XP machines and in some cases, Win7 machines, I've always had a problem getting the agents on these machines updated. Even with GPO, these agents would always fail to update. I would end up just copying the EsetUninstaller.exe to these machines and running them in safe mode to get rid of the agent and av software. I too had spent a lot of time fiddling with ESMC and GPOs to get the Agents updated but gave up and did it the hard way. That said, have you taken a look at the agent logs on the problematic machines? These logs should at least point you to what's bugging the update process. That's the way I had figured the XP agents weren't liking the update command.

I'm somewhat tending to the theory that the tags are screwing up your service loading. I've had to delete all tags that I had created in order for the service to run.

If possible, can you post more of the tracelog? It doesn't actually contain the part where the service fails to run.

As @Martink mentioned, this isn't an issue with being blocked by a firewall. We are talking about http and not some different protocol. Furthermore, it's an indication more on the server not finding the said package. If it was a network issue, you'd see something along the lines of "Cannot find or access http://repository.eset.com". That said, the first item in the log you showed seems to point out something else. "4 Unexpected error while processing..."

Hi, Using the new MirrorTool, I'm still getting an error when trying to download the updates: Mirror Tool, Copyright (c) ESET, spol. s r.o. 1992-2019. All rights reserved. Creating mirror for product: ep6. Mirror type changed to regular Initialization Initialization finished Perform full mirror started Update status for product 'ep6' changed to: Preparing structures and analyzing Downloading file: update.ver.signed. Downloaded: 100 % Downloading file: update.ver. Downloaded: 100 % Update status for product 'ep6' changed to: Downloading files Downloading file: em049_64_l1.nup. Downloaded: 0 % Update status for product 'ep6' changed to: Updating Downloaded: 100 % Update status for product 'ep6' changed to: Finished Perform full mirror finished Uninitialization Uninitialization finished Creating mirror for product: era6. Mirror type changed to regular Initialization Initialization finished Perform full mirror started Update status for product 'era6' changed to: Preparing structures and analyzing Downloading file: update.ver.signed. Downloaded: 100 % Update status for product 'era6' changed to: Downloading files Downloading file: em024_64_n7.nup. Downloaded: 100 % Update status for product 'era6' changed to: Updating Downloaded: 100 % Update status for product 'era6' changed to: Finished Perform full mirror finished Uninitialization Uninitialization finished Creating mirror for product: ep7. Mirror type changed to regular Initialization Initialization finished Perform full mirror started Update status for product 'ep7' changed to: Preparing structures and analyzing Downloading file: update.ver.signed. Downloaded: 100 % Update status for product 'ep7' changed to: Downloading files Downloading file: em049_64_n8.dll.nup. Downloaded: 58 % Update status for product 'ep7' changed to: Finished Perform full mirror finished Uninitialization Uninitialization finished Error: Perform full mirror failed with error: Error creating file. Error code is: 4118 Error occured. Though the error # is different. So perhaps a transient issue? (been trying a lot of times.. still getting that error) What does the 4118 error code mean? I've checked and I do have enough disk space. Thanks! Edmund

I think it's under %PROGRAMFILES%\Apache Software Foundation\apache-tomcat-<version>\conf.

I had major headaches doing the "GPO install Agent + AV" route. YMMV, of course; but, IMO, if you're going to just use GPO, it would make life easier if you'd just setup a policy that installs the Agent, and then use the ESMC 'Software Install' client task to install the necessary AV. again.. ymmv. Edmund

Hi, Here are a few ideas that I have: Check if the Tomcat logs say anything. Check if the Tomcat service is running. Were there any firewall changes? You mentioned that you tried to connect to the MC and that it's not available. What exact error did you get? A 404? Cannot connect (i.e. not listening to any connections)? On the ESMC server, if you do a "netstat -na", is the port available and listening? Edmund

Well, ended up the problem was twofold: 1) Java path was there, except not complete. Was missing some files. 2) Required a reboot. Edmund

Hi @pctech1380, Yes, I also have encountered this though I haven't quite gotten to figuring out why it's happening. I think the logs might have something to say about it though. Edmund

Hi, After suffering a system failure which took out the ESMC server, I had to install ESMC on a different server and after getting the appropriate things squared, I installed the all in one on a Windows 2012R2 system. Clicked on Ok by mistake and completely missed the URL for the webconsole. Anyway, after much searching I found it; but, upon logging in, and skimming through the welcome screens, the dashboard tries to load; but I eventually get the error "Error during dashboard has occurred". I click on OK, and am back on the screen but I've noticed that all the icons are missing. ;/ Just the text is available. I then try to go into the Server settings, but that managed to kill the ESMC instance as I'm booted out and can no longer go to the webconsole. I'm scanning the Server logs (those in the EraServerApplicationData), but I'm seeing some 'forcibly closed' messages. Tomcat has no logs stating why it's crashing. At least, not in the apache-tomcat-<??>/logs dir or in the Tomcat/logs dir. However, in the Event Viewer, I'm seeing "The Apache Tomcat 9.0 service terminated unexpectedly. It has done this 1 time(s)." Later on, I see another entry. That said, I'm suspecting I need to do a reboot as in the Event Viewer, I'm seeing a bunch of "Apache Tomcat terminating unexpectedly interspersed with some GPO warnings. Thanks Edmund

Agent installation ending prematurely (which I also have encountered before... though what follows is a fuzzy recollection of what I did) tends to mean something (either in the registry, or in the eset directories) are preventing it from running. Firstly, make sure you're installing it with Admin privs. Secondly, check if the Agent is *already* installed (though if you check in the Add Programs (or Programs and Features..depending on the Windows version)), if the ESET Agent exists but with no installation date or whatever, it probably means something in the system has screwed up. The *best* thing to do is to grab the EsetUninstaller and go into Safe Mode and run it. It'll detect old installations. Just remove the installed versions with the EsetUninstaller. (can be downloaded from the ESet website). HTH Edmund

Hi, I'm guessing that the DC002 is the system that the agents are trying to connect to? Do you have any agent policies set up and associated with the agents? Perhaps the agent policy setting has it on (i.e., you selected the Agent with proxy policy while creating the agent deployment packages? But IIRC, that is the default response. Have you checked that the ports on DC002 are allowing 2222? Edmund

@Rami nope. I don't have a full disk; though not sure how I can find out if it is blocked. I mean, it downloads to 63% so it is downloading (*I think*); and if it was blocked (for some reason), wouldn't it have complained about it at the beginning? Going to try to do a packet tracing and see what's going on. Thanks Edmund

It shouldn't be a problem since eventually, the computer's agent will reconnect with the ESMC. :ewong

Well, I feel a bit dense, even with the information provided. It's my understanding that the command you ran was on the AWS instance and not your workstation (or whereever you access this AWS instance). Is the ESMC server behind a firewall? If so, do you happen to have the correct port-forwarding rules? If it's a system directly connected to the Internet requiring no firewall, then check the ESMC system's firewall. If it's a windows system, check the incoming port allowances. If it's a linux ESMC system, check for selinux and iptables rules. Edmund

Just updated the MirrorTool and while the repo creation worked, the updates still fail as shown below: ============= UPDATES MODE ========== Mirror Tool, Copyright (c) ESET, spol. s r.o. 1992-2019. All rights reserved. Creating mirror for product: ep6. Mirror type changed to regular Initialization Initialization finished Perform full mirror started Update status for product 'ep6' changed to: Preparing structures and analyzing Downloading file: update.ver.signed. Downloaded: 100 % Downloading file: update.ver. Downloaded: 100 % Update status for product 'ep6' changed to: Downloading files Downloading file: em023_32_r0.dll.nup. Downloaded: 92 % Update status for product 'ep6' changed to: Updating Downloaded: 100 % Update status for product 'ep6' changed to: Finished Perform full mirror finished Uninitialization Uninitialization finished Creating mirror for product: era6. Mirror type changed to regular Initialization Initialization finished Perform full mirror started Update status for product 'era6' changed to: Preparing structures and analyzing Downloading file: update.ver.signed. Downloaded: 100 % Update status for product 'era6' changed to: Downloading files Downloading file: em045_64_n15.nup. Downloaded: 100 % Update status for product 'era6' changed to: Updating Downloaded: 38 % Update status for product 'era6' changed to: Finished Perform full mirror finished Uninitialization Uninitialization finished Error: Perform full mirror failed with error: Undocumented serious error. Error code is: 4122 Error occured.

The first thing to check to see if the server's firewall has that port blocked. :ewong

Hi, Where is this being shown in? The agent installation log or somewhere else? What operating system does this AWS instance run on? :ewong