Jump to content

j-gray

Members
 View Profile  See their activity

  • Posts

    620

  • Joined

  • Last visited

  • Days Won

    5

 Content Type 

Posts posted by j-gray

    OS X EP v7 - Web and email protection is non-functional

    in ESET Endpoint Products

    Posted

    This seems to be a recurring issue with ESET and OS X and I'm not sure what the resolution is at this point.

    We have Web and Email protection disabled in the v7 policies (same with v6). And we have the policy set to not show Web and Email statuses on the endpoints.

    Yet, v7 endpoints display to users a Protection Status alert: 'Web and email protection is non-functional'.

    This seems to be the case whether the 'ESET Web&Email' service is active or inactive in the network settings under System Preferences. If the service is fully removed, it will prompt to allow the addition of the service at reboot.

    Of course, if we leave the service active and allow it to connect, it randomly breaks network connectivity for no apparent reason.

    How can we keep this service inactive and keep the client from showing an error to our users?

    EEI | Product not activated (Topic last mentioned on March.)

    in ESET Inspect On-prem (Detection and Response)

    Posted

    I posted in the other thread, as well, but I'm finding that at least some of the v7 OS X clients that appear activated then days later show not activated log the details below. It also seems to hang on the specific date it quit working. As in, today is the 23rd, but the Events Statistics are all from: 2023-01-17 22:00:36, To:, 2023-01-17 22:00:36

    2023-01-23 08:57:00 0x70000aea1000 Info: Events sent successfully to xxx.xx.x.xx:8093. Server responded with 200 status code in 0s007ms.
    2023-01-23 08:57:09 0x70000b130000 Error: License check failed. Try 1 out of 5. Failed to process a request to/from ESET Endpoint Security/Antivirus. RUN_LOOP_ERROR RUN_LOOP_TIMEOUT (2)
    2023-01-23 08:58:12 0x70000b130000 Error: License check failed. Try 2 out of 5. Failed to process a request to/from ESET Endpoint Security/Antivirus. RUN_LOOP_ERROR RUN_LOOP_TIMEOUT (2)
    2023-01-23 08:59:16 0x70000b130000 Error: License check failed. Try 3 out of 5. Failed to process a request to/from ESET Endpoint Security/Antivirus. RUN_LOOP_ERROR RUN_LOOP_TIMEOUT (2)
    2023-01-23 09:00:19 0x70000b130000 Error: License check failed. Try 4 out of 5. Failed to process a request to/from ESET Endpoint Security/Antivirus. RUN_LOOP_ERROR RUN_LOOP_TIMEOUT (2)
    2023-01-23 09:01:22 0x70000b130000 Error: License check failed. Try 5 out of 5. Failed to process a request to/from ESET Endpoint Security/Antivirus. RUN_LOOP_ERROR RUN_LOOP_TIMEOUT (2)
    2023-01-23 09:02:25 0x70000b130000 Error: License check failed. License no longer active. Failed to process a request to/from ESET Endpoint Security/Antivirus. RUN_LOOP_ERROR RUN_LOOP_TIMEOUT (2)
    2023-01-23 09:02:25 0x70000b130000 Info: ESET Inspect integration with Endpoint has been successfully enabled

    OS X upgrade to v7 causes Product not Activated for EEI connector

    in ESET Inspect On-prem (Detection and Response)

    Posted

    As far as OS X v7, I'm having better luck with product activation, but some of them, once activated become deactivated again and log the following:

    2023-01-20 13:38:15 0x70000b130000 Info: ESET Inspect integration with Endpoint has been successfully enabled
    2023-01-20 13:39:19 0x70000b130000 Error: License check failed. Try 1 out of 5. Failed to process a request to/from ESET Endpoint Security/Antivirus. RUN_LOOP_ERROR RUN_LOOP_TIMEOUT (2)
    2023-01-20 13:40:22 0x70000b130000 Error: License check failed. Try 2 out of 5. Failed to process a request to/from ESET Endpoint Security/Antivirus. RUN_LOOP_ERROR RUN_LOOP_TIMEOUT (2)
    2023-01-20 13:41:25 0x70000b130000 Error: License check failed. Try 3 out of 5. Failed to process a request to/from ESET Endpoint Security/Antivirus. RUN_LOOP_ERROR RUN_LOOP_TIMEOUT (2)
    2023-01-20 13:42:28 0x70000b130000 Error: License check failed. Try 4 out of 5. Failed to process a request to/from ESET Endpoint Security/Antivirus. RUN_LOOP_ERROR RUN_LOOP_TIMEOUT (2)
    2023-01-20 13:43:31 0x70000b130000 Error: License check failed. Try 5 out of 5. Failed to process a request to/from ESET Endpoint Security/Antivirus. RUN_LOOP_ERROR RUN_LOOP_TIMEOUT (2)

    2023-01-20 13:36:46 0x70000aea1000 Info: Events sent successfully to xxx.xx.xx.x:8093. Server responded with 200 status code in 0s016ms.
    2023-01-20 13:38:15 0x70000b130000 Error: License check failed. License no longer active. Failed to process a request to/from ESET Endpoint Security/Antivirus. RUN_LOOP_ERROR RUN_LOOP_TIMEOUT (2)

    OS X upgrade to v7 causes Product not Activated for EEI connector

    in ESET Inspect On-prem (Detection and Response)

    Posted

    @Peter Randziak Sorry about that, too many support cases. It should be #00444283. I'm unable to edit my previous post, however.

    In our case, we would see the following logged and EP console would show not activated. Note the 1969-12-31 date:

    2022-11-29 00:00:32 00d08 Error: License check failed. License no longer active. Request to ESET Endpoint Security/Antivirus failed. Error PERSEUS_E_EI_NO_LICENSE (21801)
    2022-11-29 00:00:32 00d08 Info: ESET Inspect integration with Endpoint has been successfully enabled
    2022-11-29 00:01:32 00d08 Error: License check failed. Try 1 out of 5. Request to ESET Endpoint Security/Antivirus failed. Error PERSEUS_E_EI_NO_LICENSE (21801)
    2022-11-29 00:02:32 00d08 Error: License check failed. Try 2 out of 5. Request to ESET Endpoint Security/Antivirus failed. Error PERSEUS_E_EI_NO_LICENSE (21801)
    2022-11-29 00:03:32 00d08 Error: License check failed. Try 3 out of 5. Request to ESET Endpoint Security/Antivirus failed. Error PERSEUS_E_EI_NO_LICENSE (21801)
    2022-11-29 00:04:32 00d08 Error: License check failed. Try 4 out of 5. Request to ESET Endpoint Security/Antivirus failed. Error PERSEUS_E_EI_NO_LICENSE (21801)
    2022-11-29 00:04:45 00be8 Info: Events Statistics, From:, 1969-12-31 17:00:00, To:, 1969-12-31 17:00:00, Duration (s):, 0, Events Per Second:, 0.000, Events:, 0, File:, 0, Registry:, 0, TcpIp:, 0, Http:, 0, Dns:, 0, Process:, 0, Injections:, 0, Dll:, 0, Traffic:, 0, Info:, 0, Metadata:, 0, Livegrid:, 0, OriginUrl:, 0, Alarms:, 0, UserActivity:, 0, Wmi:, 0, Scripts:, 0, ExeDrops:, 0, OpenProcess:, 0, TrafficSize:, 0, TrafficInterval:, 0, Executions:, 0, Subprocesses:, 0, Connections:, 0, LoadUnloadDriver:, 0, Batch Size (bytes):, 15
    2022-11-29 00:04:50 00938 Info: Events sent successfully to server.ip:8093. Server responded with 200 status code in 0s011ms.
    2022-11-29 00:05:32 00d08 Error: License check failed. Try 5 out of 5. Request to ESET Endpoint Security/Antivirus failed. Error PERSEUS_E_EI_NO_LICENSE (21801)
    2022-11-29 00:06:32 00d08 Error: License check failed. License no longer active. Request to ESET Endpoint Security/Antivirus failed. Error PERSEUS_E_EI_NO_LICENSE (21801)
    2022-11-29 00:06:32 00d08 Info: ESET Inspect integration with Endpoint has been successfully enabled

    OS X upgrade to v7 causes Product not Activated for EEI connector

    in ESET Inspect On-prem (Detection and Response)

    Posted

    9 hours ago, Leo Gr said:

    Hi guys, based on the commented error, I confirm one of the solutions indicated here as well. We recently had a customer with a similar problem (windows server 2016)
    Error:
    License check failed. Try 1 out of 5. Request to ESET Endpoint Security/Antivirus failed. Error PERSEUS_E_EI_NO_LICENSE (21801)

    The EI was not showing activated despite having an active license.
    Checking thoroughly, this client had a license renewal which still did not show up to date. What was done in this case was to uninstall the ESS and then the EI on that computer, both were reinstalled and by jointly reviewing the installer log it was possible to verify that it was activated without problems and the error did not return. In this particular case, the client had EP v10/ ESS v9 and EI v1.9.

    Leo.

    It seems that for OS X, licenses are actually current and activated, but reported as Inactivated in EP Console. Therefore, subsequent activation tasks all seem to fail.

    In our case with upgrading EI Connector on the Windows servers, the Connector data actually became corrupted as indicated by a 1969 year date in the log files. Uninstall of EI Connector only and reboot resolved the corruption issue.

    Engineers discovered this, though unfortunately don't seem interested in determing root cause and/or registering a bug, despite being able to reproduce this consistently. Case #00477123 if anyone is interested in referencing it.

    Dynamic template for Product Not Activated

    in ESET PROTECT On-prem (Remote Management)

    Posted

    Thanks, that makes sense.

    I've run into another query trying to capture OS X devices that don't have Full Disk Access for the AV component.

    The client > detail > alerts' show Problem = "The ESET security product doesn't have Full Disk Access" and Problem Detail = "macOS is preventing the ESET security product from accessing some folders"

    I've found the option where 'Functionality/Protection problems . Problem' is one of "macOS is preventing the ESET security product from accessing some folders", but this does not return any of the systems with that status.

    Any thoughts on how to structure this query?

    Thanks again.

    EEI | Product not activated (Topic last mentioned on March.)

    in ESET Inspect On-prem (Detection and Response)

    Posted

    On 1/13/2023 at 4:39 AM, Peter Randziak said:

    The Auto-updates should make it much easier to maintain.

    Unfortunately, this isn't really an option. We still have to vet and test each update, and then allow the upgrades on a managed timeline. This allows us to recover from a botched upgrade, similar to what we saw with the latest EI Connector on all our Windows servers when the upgrade caused the EI connector to become corrupted.

    EEI | Product not activated (Topic last mentioned on March.)

    in ESET Inspect On-prem (Detection and Response)

    Posted

    3 hours ago, avielc said:

    About EI. 
    EPv10 works as usual, so I didn't see anything related to that being affecting EI or EEAv7

     

    Regarding logs, I'm having issues with that. 
    I can not have it done on an employee's computer. 
    and I will need to have ECP logging enabled for 2-3 days running on a demo machine that won't be doing any tasks, so I can't tell if I can reproduce it. 
     

    I hope he can play with it and reproduce it easily, if he needs more steps from me to reproduce it, please let me know. 

    @j-gray - if you mind sharing your findings on that workaround. 

    We have not made the jump to EPv10.

    I'm having difficulty keeping up with all the updates and patches across two platforms (Windows and OS X), EP and EI servers, clients, agents and connectors. It's also difficult to troubleshoot support issues when versions keep changing.

    EEI | Product not activated (Topic last mentioned on March.)

    in ESET Inspect On-prem (Detection and Response)

    Posted

    4 hours ago, Peter Randziak said:

    Hello guys,

    I can confirm that EEA/EES 6 for macOS does not have the EI/EEI licensing module implemented.
    Glad to hear that you were able to find the cause of the issue with the support team.

    @Peter Randziak The OS X license module bug was discovered last January, a year ago. I'm guessing that there are no plans  to fix the bug in v6.

    We're slowly upgrading OS X to EPv7, but that brings its own set of issues and we have 800 clients, so it will be a slow process.

    Dynamic template for Product Not Activated

    in ESET PROTECT On-prem (Remote Management)

    Posted

    We have a dynamic template set for 'Functionality/Protection problems . Problem' = 'product not activated'

    But we have two products that need to be activated with different license files.

    EP clients show EP status as 'Product not activated',  and product = 'Security Product'

    EI Connector shows EP status as 'Product not activated', and product = 'ESET Inspect Connector'

    The dynamic template catches both inactivated instances, but can only apply one license file specified. Is it possible to create a dynamic template for each separate case?

    EEI | Product not activated (Topic last mentioned on March.)

    in ESET Inspect On-prem (Detection and Response)

    Posted

    @Peter Randziak; Welcome back -hope you had a relaxing break!

    I think a good part of the activation issues are due to a bug associated with one of our cases, #00291733. I wasn't given a bug number for reference or tracking, however. Reportedly, ESET support was able to reproduce the issue and attributed it to EEI Agents on OS X "do not support licenses".

    So in our case, for AV v6 any Connector upgrade reports failed (but succeeds) if the license file is included in the task. Additionally, any new install reports failed if license file is included in the task. This has been the case with multiple versions, including 1.9.

    I believe the activation issue with AV v7 has been fixed, but still need to to more testing on that front.

    Server 2012 upgrade with ESET Protect

    in ESET PROTECT On-prem (Remote Management)

    Posted

    Just FYI for anyone interested. I upgraded our ESET virtual server from Windows 2012 R2 to 2016. It was mostly successful, except once complete, Apache Tomcat no longer existed as a service. I'm not sure if this is to be expected, or not.

    As I still had the ESET Server install files, I re-ran the setup and it did not detect Tomcat, so gave me the option to install it. Once that was done, everything seems to be working fine.

    EEI version 1.9 server upgrade fails with error

    in ESET Inspect On-prem (Detection and Response)

    Posted

    @Mitchell Thanks for the quick reply. I can't think of a reason that writing the file would be blocked. This server is dedicated to EEI and I've successfully upgraded multiple versions in the past without issue using the same login id.

    Aside from the above error that's logged in the install log file, I see the following:

    DEBUG: Error 2826:  Control Co.databaseDataCollection.DataCollectionLevel on dialog Di.databaseDataCollection extends beyond the boundaries of the dialog to the right by 26 pixels
    The installer has encountered an unexpected error installing this package. This may indicate a problem with this package. The error code is 2826. The arguments are: Di.databaseDataCollection, Co.databaseDataCollection.DataCollectionLevel, to the right
     

    DEBUG: Error 2826:  Control Co.databaseDataCollection.DataCollectionLevelModify on dialog Di.databaseDataCollection extends beyond the boundaries of the dialog to the right by 26 pixels
    The installer has encountered an unexpected error installing this package. This may indicate a problem with this package. The error code is 2826. The arguments are: Di.databaseDataCollection, Co.databaseDataCollection.DataCollectionLevelModify, to the right
     

    DEBUG: Error 2827:  The button Custom data collection settings on the radiobutton group Co.databaseDataCollection.DataCollectionLevelModify on dialog Di.databaseDataCollection extends beyond the boundaries of the group on the bottom by 10 pixels
    The installer has encountered an unexpected error installing this package. This may indicate a problem with this package. The error code is 2827. The arguments are: Di.databaseDataCollection, Co.databaseDataCollection.DataCollectionLevelModify, Custom data collection settings
     

    OS X upgrade to v7 causes Product not Activated for EEI connector

    in ESET Inspect On-prem (Detection and Response)

    Posted · Edited by j-gray
    spelling correction

    Sorry, that was a bit long. In short, EP v6 on OS X has no issues with activation. After upgrade to v7 I cannot get to activate even after uninstall/reboot/reinstall. I haven't tried it, but suspect a clean install of v7 (not upgrade) will succeed.

    For Windows server, clean install with license file specified succeeds without errors. Only in-place upgrade with license specified fails to activate afterward. In this case, the only solution I've found is to uninstall connector, reboot and reinstall connector (with or without license file).

    OS X upgrade to v7 causes Product not Activated for EEI connector

    in ESET Inspect On-prem (Detection and Response)

    Posted

    1 minute ago, avielc said:

    Just to make sure I understand right: 
    the same process for OS X of uninstalling, rebooting reinstalling doesn't help with the activation. 
    but for the Windows Server you wanted to have EI on, installing a regular task with license key fails to activate the product and only after uninstalling rebooting and reinstalling again it'll catch the activation? (the task will remain the same? ) 

    Specific to OS X and Protect v6:

    • Any EI Connector upgrade task with license specified appears to run for about 30 minutes and eventually reports failed in EP Console even though it completes successfully on the client.
    • EI Connector upgrade without license specified completes successfully within less than 10 minutes.

    Specific to OS X and Protect v7:

    • Same behavior as above plus issues below.
    • After EP upgrade from v6 to v7, EI Connector shows not activated, even though it was activated and healthy prior to EP  upgrade.
    • Subsequent activation tasks appear to complete successfully in EP Console, but EP Console still reflects not activated.
    • EI connector uninstall/reboot/reinstall does not resolve not activated status in EP Console.

    Specific to Windows Servers

    • In-place upgrade of EI Connector with license specified causes EI Connector to show not activated in EP Console.
    • Subsequent activation tasks complete successfully, but EI Connector still reflects not activated in EP Console.
    • In-place upgrade of EI Connector without license specified completes successfully. EI Connector remains activated.
    • In the case where in-place upgrade causes EI Connector to show not activated, uninstall/reboot/reinstall of EI Connector resolves the activation issue.
      • Uninstall/reinstall of EI Connector without reboot still fails any activation tasks.

    I've upgraded the EEI server to each of that last two updates (not listed on the forums here)1.8.2214.0 and 1.8.2218.0 and did not see any change in the above behaviors.

    Still haven't seen any info on the 1.9 release.

    OS X upgrade to v7 causes Product not Activated for EEI connector

    in ESET Inspect On-prem (Detection and Response)

    Posted

    Just wanted to update this with my findings. In-place Windows server upgrades of the EI Connecter were completing successfully but failing to activate afterwards. Uninstall, reboot and reinstall would resolve the issue.

    I also just found that the in-place upgrades will complete successfully if the license is not configured in the install task.

    I have a support case open and spent considerable time with remote sessions, collecting logs, etc. Support was not able to determine what was causing these upgrades to fail and why the servers would not reflect successful activation.

    So in short, specifying a license for a Windows Server EI Connector upgrade task causes the EI connector to report an unactivated status. Subsequent activation tasks fail. Uninstall, reboot, reinstall is required to resolve the issue.

    I have no idea why specifying a license would cause this failure. Support does not know, either.

    Still no progress on the OS X issues.

×
×
  • Create New...