Excessive Malformed Rule String Detected, Unparseable Date or other Host IPS Property Translator messages (in ePolicy Orchestrator 5.x Orion.log)

Technical Articles ID: KB71607
Last Modified: 6/11/2019

Environment

McAfee ePolicy Orchestrator (ePO) 5.x
McAfee Host Intrusion Prevention (Host IPS) 8.0

Summary

This article explains how to address the ePO 5.x Orion.log file messages for the Host IPS Property Translator feature.

Problem

Excessive CPU consumption for ePO 5.x application server.

Problem

ePO console experiences the following intermittent issues during policy configuration changes, causing timeouts within the ePO console:

Unable to log in to the ePO console
Console locks up
Console slowness
Console disconnects

Problem

Many repetitive messages (related to the following) display when reviewing the ePO 5.x Orion.log file:

.propertytranslator.

Problem

When reviewing the ePO 5.x Orion.log file, many of the following messages display:

2011-02-28 08:23:16,773 ERROR [mfs:pool-1-thread-70] propertytranslator.FWRuleProcessor - Malformed rule string detected. Ignoring.
java.text.ParseException: Unparseable date: ""

Cause

This message indicates that a Host IPS client has uploaded local IPS, Firewall, or Application Blocking client rules (created manually or via Learn/Adaptive mode functionality), and one or more of the systems' client rules has unparseable information.

Solution

This issue is resolved in the Host IPS 8.0.0.600 extension update.

Contact Technical Support and request this extension update. See KB77510 for the Host IPS 8.0.0.600 Extension Update Known Issues.

To contact Technical Support, log on to the ServicePortal and go to the Create a Service Request page at https://support.mcafee.com/ServicePortal/faces/serviceRequests/createSR:

If you are a registered user, type your User Id and Password, and then click Log In.
If you are not a registered user, click Register and complete the required fields. Your password and logon instructions will be emailed to you.

IMPORTANT: The following files are required for Technical Support:

Minimum Escalation Requirements (MER) files for your specific product. For information about downloading the MERs for each McAfee product, see KB59385.
Other files and logs, as requested by Technical Support.

As a temporary measure, implement the following workarounds.

Workaround

If you see that a large number of these messages are being logged, ensure you have followed the applicable Host IPS best practices in the "Best Practices for Quick Success" section of the Host Intrusion Prevention 8.0 Installation Guide (PD22891):

Disable Adaptive mode if enabled for the IPS module.
Disable Adaptive mode if enabled for the Firewall module.
Deselect Retain client rules option for all systems to clear client rules and prevent them from being sent back to the ePO server.

NOTE: Host IPS Adaptive mode functionality is designed to be used for brief periods of time on a limited number of systems to assist with tuning Host IPS policies.

If you still experience the issue, contact Technical Support for additional assistance.

To contact Technical Support, log on to the ServicePortal and go to the Create a Service Request page at https://support.mcafee.com/ServicePortal/faces/serviceRequests/createSR:

If you are a registered user, type your User Id and Password, and then click Log In.
If you are not a registered user, click Register and complete the required fields. Your password and logon instructions will be emailed to you.

Related Information

Host IPS 8.0 Adaptive Mode documentation
See the "Activate adaptive mode" section of the Host Intrusion Prevention 8.0 Installation Guide (PD22891).

Affected Products

Host Intrusion Prevention 8.0

Languages:

This article is available in the following languages:

English United States
Japanese

Glossary of Technical Terms

Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.

Knowledge Center

Excessive Malformed Rule String Detected, Unparseable Date or other Host IPS Property Translator messages (in ePolicy Orchestrator 5.x Orion.log)

Environment

Summary

Problem

Problem

Problem

Problem

Cause

Solution

Workaround

Related Information

Affected Products

Languages:

Glossary of Technical Terms

Title

Title

Knowledge Center

Excessive Malformed Rule String Detected, Unparseable Date or other Host IPS Property Translator messages (in ePolicy Orchestrator 5.x Orion.log)

Environment

Summary

Problem

Problem

Problem

Problem

Cause

Solution

Workaround

Related Information

Affected Products

Languages:

Glossary of Technical Terms

Choose your region

Title

Title