circumpunct 2 Posted June 24, 2015 Share Posted June 24, 2015 We have ESET File Security 6 running on Windows Server 2008 R2 Standard, and ERA 6 running on a separate dedicated Win 7 PC in the same domain. ESFS won't talk to the ERA. No errors. Just it does not make contact. All other PCs talk to the ERA with no problem. We suspected the Server firewall, but nothing obvious shows up and the agent has a free pass though both machines. I'm not yet up to speed on the ver 6 logs, but nothing jumps out. It just looks like the agent isn't trying. Where is a good point to start investigating this? Link to comment Share on other sites More sharing options...
jimwillsher 65 Posted June 24, 2015 Share Posted June 24, 2015 On the server, have a look at the logs in c:\ProgramData\ESET\RemoteAdministrator\Agent\EraAgentApplicationData\Logs\ Jim Link to comment Share on other sites More sharing options...
circumpunct 2 Posted June 28, 2015 Author Share Posted June 28, 2015 Thanks Jim. What am I looking for? No mention of the errant machine by name or ip. Just yards of this sort of thing: 2015-06-17 06:48:34 Information: SchedulerModule [Thread a4c]: Received message: RegisterTimeEvent2015-06-17 06:48:34 Information: CDynamicGroupsModule [Thread a7c]: Refreshing static groups after replication2015-06-17 06:48:35 Information: CDynamicGroupsModule [Thread a7c]: Retrieving currently matching dynamic groups with static groups path to root2015-06-17 06:48:35 Information: SchedulerModule [Thread a4c]: Received message: GetRemainingTimeByUserDataRequest2015-06-17 06:48:35 Information: SchedulerModule [Thread a4c]: Received message: RegisterSleepEvent2015-06-17 06:48:35 Information: CPoliciesModule [Thread 588]: Applied policies list status log published2015-06-17 06:48:35 Information: CPoliciesModule [Thread 588]: ReevaluateActivePolicy sent message CApplyPolicy2015-06-17 06:48:35 Information: CPoliciesModule [Thread 588]: Apply policy message published2015-06-17 06:48:35 Information: CPoliciesModule [Thread 588]: Applied policies count status log published2015-06-17 06:48:35 Information: Kernel [Thread 588]: Started module CPoliciesModule (used 1604 KB)2015-06-17 06:48:35 Information: Kernel [Thread 588]: Starting module CSystemConnectorModule2015-06-17 06:48:35 Information: Kernel [Thread 588]: Started module CSystemConnectorModule (used 28 KB)2015-06-17 06:48:35 Information: Kernel [Thread 588]: Starting module CEssConnectorModule2015-06-17 06:48:35 Information: Kernel [Thread 588]: Started module CEssConnectorModule (used 28 KB)2015-06-17 06:48:35 Information: Kernel [Thread 588]: Starting module ERAG1ClientConnector2015-06-17 06:48:35 Information: Kernel [Thread 588]: Started module ERAG1ClientConnector (used 0 KB)2015-06-17 06:48:35 Information: Kernel [Thread 588]: Starting module CMDMCoreConnectorModule2015-06-17 06:48:35 Information: Kernel [Thread 588]: Started module CMDMCoreConnectorModule (used 0 KB)2015-06-17 06:48:35 Information: Kernel [Thread 588]: Starting module CVAHCoreConnectorModule2015-06-17 06:48:35 Information: Kernel [Thread 588]: Started module CVAHCoreConnectorModule (used 0 KB)2015-06-17 06:48:35 Information: Kernel [Thread 588]: Starting module AgentToProxyConnectorModule2015-06-17 06:48:35 Information: Kernel [Thread 588]: Started module AgentToProxyConnectorModule (used 0 KB)2015-06-17 06:48:35 Information: Kernel [Thread 588]: Starting module CRDSensorConnectorModule2015-06-17 06:48:35 Information: Kernel [Thread 588]: Started module CRDSensorConnectorModule (used 0 KB)2015-06-17 06:48:35 Information: CEssConnectorModule [Thread aa0]: Connecting to product2015-06-17 06:48:35 Information: Kernel [Thread 588]: Used memory after modules start-up is 23556 KB2015-06-17 06:48:35 Information: CSystemConnectorModule [Thread a9c]: Connecting to product Link to comment Share on other sites More sharing options...
jimwillsher 65 Posted June 28, 2015 Share Posted June 28, 2015 Nothing beyond the last line? The rest looks normal, as that's the startup logic. What do you see if you double-click the status file in the same folder? Link to comment Share on other sites More sharing options...
circumpunct 2 Posted June 28, 2015 Author Share Posted June 28, 2015 Yes, that is the tail of the log file including the last line. Status file shows all green. No errors. Link to comment Share on other sites More sharing options...
jimwillsher 65 Posted June 29, 2015 Share Posted June 29, 2015 If it's green then that means it has contacted the ERA as it's been able to download the certificates. Are you sure it's not in the lost and found group? Link to comment Share on other sites More sharing options...
circumpunct 2 Posted July 1, 2015 Author Share Posted July 1, 2015 Problem solved. It was showing in the 'not connected' report of ERA, but it seems to have been old data. We deleted it from ERA and let it recreate itself and now all is fine. Link to comment Share on other sites More sharing options...
Recommended Posts