File Secuirity 6 wont talk to ERA 6

[circumpunct 2]

We have ESET File Security 6 running on Windows Server 2008 R2 Standard, and ERA 6 running on a separate dedicated Win 7 PC in the same domain.

 

ESFS won't talk to the ERA. No errors. Just it does not make contact. All other PCs talk to the ERA with no problem. We suspected the Server firewall, but nothing obvious shows up and the agent has a free pass though both machines.

 

I'm not yet up to speed on the ver 6 logs, but nothing jumps out. It just looks like the agent isn't trying.

 

Where is a good point to start investigating this?

 

 

 

[jimwillsher 65]

On the server, have a look at the logs in c:\ProgramData\ESET\RemoteAdministrator\Agent\EraAgentApplicationData\Logs\

 

 

Jim

[circumpunct 2]

Thanks Jim.

 

What am I looking for?

 

No mention of the errant machine by name or ip.

 

Just yards of this sort of thing:

 

2015-06-17 06:48:34 Information: SchedulerModule [Thread a4c]: Received message: RegisterTimeEvent
2015-06-17 06:48:34 Information: CDynamicGroupsModule [Thread a7c]: Refreshing static groups after replication
2015-06-17 06:48:35 Information: CDynamicGroupsModule [Thread a7c]: Retrieving currently matching dynamic groups with static groups path to root
2015-06-17 06:48:35 Information: SchedulerModule [Thread a4c]: Received message: GetRemainingTimeByUserDataRequest
2015-06-17 06:48:35 Information: SchedulerModule [Thread a4c]: Received message: RegisterSleepEvent
2015-06-17 06:48:35 Information: CPoliciesModule [Thread 588]: Applied policies list status log published
2015-06-17 06:48:35 Information: CPoliciesModule [Thread 588]: ReevaluateActivePolicy sent message CApplyPolicy
2015-06-17 06:48:35 Information: CPoliciesModule [Thread 588]: Apply policy message published
2015-06-17 06:48:35 Information: CPoliciesModule [Thread 588]: Applied policies count status log published
2015-06-17 06:48:35 Information: Kernel [Thread 588]: Started module CPoliciesModule (used 1604 KB)
2015-06-17 06:48:35 Information: Kernel [Thread 588]: Starting module CSystemConnectorModule
2015-06-17 06:48:35 Information: Kernel [Thread 588]: Started module CSystemConnectorModule (used 28 KB)
2015-06-17 06:48:35 Information: Kernel [Thread 588]: Starting module CEssConnectorModule
2015-06-17 06:48:35 Information: Kernel [Thread 588]: Started module CEssConnectorModule (used 28 KB)
2015-06-17 06:48:35 Information: Kernel [Thread 588]: Starting module ERAG1ClientConnector
2015-06-17 06:48:35 Information: Kernel [Thread 588]: Started module ERAG1ClientConnector (used 0 KB)
2015-06-17 06:48:35 Information: Kernel [Thread 588]: Starting module CMDMCoreConnectorModule
2015-06-17 06:48:35 Information: Kernel [Thread 588]: Started module CMDMCoreConnectorModule (used 0 KB)
2015-06-17 06:48:35 Information: Kernel [Thread 588]: Starting module CVAHCoreConnectorModule
2015-06-17 06:48:35 Information: Kernel [Thread 588]: Started module CVAHCoreConnectorModule (used 0 KB)
2015-06-17 06:48:35 Information: Kernel [Thread 588]: Starting module AgentToProxyConnectorModule
2015-06-17 06:48:35 Information: Kernel [Thread 588]: Started module AgentToProxyConnectorModule (used 0 KB)
2015-06-17 06:48:35 Information: Kernel [Thread 588]: Starting module CRDSensorConnectorModule
2015-06-17 06:48:35 Information: Kernel [Thread 588]: Started module CRDSensorConnectorModule (used 0 KB)
2015-06-17 06:48:35 Information: CEssConnectorModule [Thread aa0]: Connecting to product
2015-06-17 06:48:35 Information: Kernel [Thread 588]: Used memory after modules start-up is 23556 KB
2015-06-17 06:48:35 Information: CSystemConnectorModule [Thread a9c]: Connecting to product

[jimwillsher 65]

Nothing beyond the last line? The rest looks normal, as that's the startup logic.

 

What do you see if you double-click the status file in the same folder?

[circumpunct 2]

Yes, that is the tail of the log file including the last line.

 

Status file shows all green. No errors.

[jimwillsher 65]

If it's green then that means it has contacted the ERA as it's been able to download the certificates. Are you sure it's not in the lost and found group?

[circumpunct 2]

Problem solved.

 

It was showing in the 'not connected' report of ERA, but it seems to have been old data.

 

We deleted it from ERA and let it recreate itself and now all is fine.