avielc 56 Posted April 27, 2022 Share Posted April 27, 2022 I noticed since yesterday 2 devices not registering properly with all the icons and in the ESET PROTECT. From further drill down today it seems to evolve from EPNS not working well. the error I see is the following: ERROR: Request: Era.Common.Services.Replication.PublishLogRequest on connection: host: "###Internal##########" port: 2222 with proxy set as: Proxy: Connection: ############Proxy address########, Credentials: Name: , Password: ******, Enabled:1, EnabledFallback:1, failed with error code: 4, error message: Deadline Exceeded, and error details: . Request Id: 12d7feec-ddf5-4721-a4df-515ecd925b82 Replication details: [Task: CLogImportantTask, Scenario: Automatic replication (REGULAR), Connection: ###Internal##########:2222, Connection established: true, Replication inconsistency detected: false, Server busy state detected: false, Realm change detected: false, Realm uuid: cdc3daa1-9e91-49d9-9ed8-e47c689f657d, Sent logs: 0, Cached static objects: 175, Cached static object groups: 11, Static objects to save: 0, Static objects to delete: 0, Modified static objects: 0] All replication attempts: 5 Also checking the proxy I get the following error on the apache log - (this is apache server in the cloud) - [27/Apr/2022:13:12:33 +0000] "CONNECT epns.eset.com:8883 HTTP/1.1" 403 219 "-" "-" - [27/Apr/2022:13:12:33 +0000] "CONNECT epns.eset.com:443 HTTP/1.1" 403 218 "-" "-" - [27/Apr/2022:13:12:42 +0000] "CONNECT epns.eset.com:8883 HTTP/1.1" 403 219 "-" "-" - [27/Apr/2022:13:12:42 +0000] "CONNECT epns.eset.com:443 HTTP/1.1" 403 218 "-" "-" - [27/Apr/2022:13:13:12 +0000] "CONNECT epns.eset.com:8883 HTTP/1.1" 403 219 "-" "-" - [27/Apr/2022:13:13:12 +0000] "CONNECT epns.eset.com:443 HTTP/1.1" 403 218 "-" "-" any thoughts on the matter would be welcome Thanks! Link to comment Share on other sites More sharing options...
ESET Moderators Peter Randziak 1,177 Posted April 28, 2022 ESET Moderators Share Posted April 28, 2022 Hello @avielc, I assume that the agent data replication to the server won't be caused by the issues with EPNS. I will respond on your private message on it, hopefully soon 🙂 In case of issues with EPNS, enable the Push messaging advanced log, reproduce the issue, disable the logging and send us the log to check. Peter Link to comment Share on other sites More sharing options...
avielc 56 Posted April 28, 2022 Author Share Posted April 28, 2022 Hi Peter Thanks for replying, I think EPNS was something outside the on-premise ESMC. Could it be you're confusing ESET Network Protection with ESET Push Notifications Service? Link to comment Share on other sites More sharing options...
ESET Moderators Peter Randziak 1,177 Posted April 29, 2022 ESET Moderators Share Posted April 29, 2022 Hello, EPNS stands for ESET Push Notification Service and yes that is outside of the on-prem ESET PROTECT, details available at https://help.eset.com/protect_admin/90/en-US/epns.html and https://support.eset.com/en/kb332-ports-and-addresses-required-to-use-your-eset-product-with-a-third-party-firewall#EPNS "ESET Network Protection" is a security feature of the Endpoints. Malfunction of either of them shouldn't cause issues with reporting to ESET PROTECT... Peter Link to comment Share on other sites More sharing options...
ESET Staff MartinK 384 Posted May 2, 2022 ESET Staff Share Posted May 2, 2022 As mentioned, EPNS service connectivity is unrelated to issues you mentioned - EPNS in this case is used to wake-up device, used for example to make modifications to device faster (i.e. executing ASAP task sooner than deice would connect depending on it's connection interval) - I guess communication to epns.eset.com was blocked in this environment which seems to be indicated by 403 response? In case issue with 2 devices still persist, I would recommend to double check there are no "clones" in the console. If no, troubleshooting guide: https://help.eset.com/protect_admin/90/en-US/fs_agent_connection_troubleshooting.html provides more hints - .e. checking status.html log might provide quick status, especially whether AGENT is actually running and whether it is attempting to connect to correct "destination". Peter Randziak 1 Link to comment Share on other sites More sharing options...
Recommended Posts