Host IPS Property Translator messages in Orion.log

Technical Articles ID: KB71607
Last Modified: 11/17/2020

Environment

McAfee ePolicy Orchestrator (ePO) 5.x
McAfee Host Intrusion Prevention (Host IPS) 8.0

Summary

This article explains how to address the ePO 5.x Orion.log file messages for the Host IPS Property Translator feature.

Problem

Excessive CPU consumption for ePO 5.x application server.

Problem

ePO console experiences the following intermittent issues during policy configuration changes. The issues can cause timeouts within the ePO console:

Unable to log on to the ePO console
Console locks up
Console slowness
Console disconnects

Problem

Many repetitive messages related to the following are displayed when reviewing the ePO 5.x Orion.log file:

.propertytranslator.

Problem

When you review the ePO 5.x Orion.log file, many of the following messages are displayed:

2011-02-28 08:23:16,773 ERROR [mfs:pool-1-thread-70] propertytranslator.FWRuleProcessor - Malformed rule string detected. Ignoring.
java.text.ParseException: Unparseable date: ""

Cause

This message indicates both of the following:

A Host IPS client has uploaded local IPS, Firewall, or Application Blocking client rules. (These rules are created manually or via Learn/Adaptive mode functionality.)
One or more of the systems' client rules has unparseable information.

Solution

This issue is resolved in the Host IPS 8.0.0.600 extension update.

Contact Technical Support and request this extension update. See KB77510 for the Host IPS 8.0.0.600 Extension Update Known Issues.

To contact Technical Support, go to the Create a Service Request page and log on to the ServicePortal.

If you are a registered user, type your User ID and Password, and then click Log In.
If you are not a registered user, click Register and complete the fields to have your password and instructions emailed to you.

IMPORTANT: The following files are required for Technical Support:

Minimum Escalation Requirements (MER) files for your specific product. For information about downloading the MERs for each McAfee product, see KB59385 - How to use MER tools with supported McAfee products.
Other files and logs, as requested by Technical Support.

As a temporary measure, implement the following workarounds.

Workaround

If you see that several of these messages are being logged, ensure you have followed the applicable Host IPS best practices. These practices are outlined in the "Best Practices for Quick Success" section of the Host Intrusion Prevention 8.0 Installation Guide:

Disable Adaptive mode if enabled for the IPS module.
Disable Adaptive mode if enabled for the Firewall module.
Deselect Retain client rules option for all systems to clear client rules and prevent them from being sent back to the ePO server.

NOTE: Host IPS Adaptive mode functionality is designed to help with tuning Host IPS policies. But, use it for brief periods of time on a limited number of systems.

If you still experience the issue, contact Technical Support for assistance.

To contact Technical Support, go to the Create a Service Request page and log on to the ServicePortal.

If you are a registered user, type your User ID and Password, and then click Log In.
If you are not a registered user, click Register and complete the fields to have your password and instructions emailed to you.

Related Information

Host IPS 8.0 Adaptive Mode documentation
See the "Activate adaptive mode" section of the Host Intrusion Prevention 8.0 Installation Guide.

Affected Products

Host Intrusion Prevention 8.0

Languages:

This article is available in the following languages:

English United States
Japanese

Glossary of Technical Terms

Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.

Knowledge Center

Host IPS Property Translator messages in Orion.log

Environment

Summary

Problem

Problem

Problem

Problem

Cause

Solution

Workaround

Related Information

Affected Products

Languages:

Glossary of Technical Terms

Title

Title

Knowledge Center

Host IPS Property Translator messages in Orion.log

Environment

Summary

Problem

Problem

Problem

Problem

Cause

Solution

Workaround

Related Information

Affected Products

Languages:

Glossary of Technical Terms

Choose your region

Title

Title