Loading...

Knowledge Center


Application Control (Solidcore) inventory is not present in ePO 5.x
Technical Articles ID:   KB79173
Last Modified:  7/13/2018
Rated:


Environment

McAfee Application Control (MAC) 6.1 
McAfee ePolicy Orchestrator (ePO) 5.x

Problem

The Application Control inventory is blank after the ePO client task SC: Pull Inventory completes successfully.

The orion.log logs the following messages when this occurs. MAC extension 6.1.3 and later also logs these messages in the server task log.
2013-07-22 15:04:38,050 WARN  [mfs:pool-2-thread-4] dao.DataChannelDAOImpl  - deleted 1059 rows from scor_data_channel with data_type = SCORInventory and maxchunks = 1024
2013-07-29 10:18:23,248 WARN  [mfs:pool-2-thread-16] dao.DataChannelDAOImpl  - deleted 1059 rows from scor_data_channel with data_type = SCORInventory and maxchunks = 1024
2013-07-17 17:04:47,875 WARN  [mfs:pool-2-thread-12] dao.DataChannelDAOImpl  - deleted 2114 rows from scor_data_channel with data_type = SCORInventory and maxchunks = 1024
2013-07-18 10:09:01,729 WARN  [mfs:pool-2-thread-15] dao.DataChannelDAOImpl  - deleted 1057 rows from scor_data_channel with data_type = SCORInventory and maxchunks = 1024
 
NOTE: If you are using the MAC 6.1.2 extension, you must change the log level to Debug to see these errors. See KB52369 for details on changing the log level. Then, add the following entry in log-config.xml:

                <logger name="com.mcafee.scor.datachannel ">

                              <level value="debug"/>

               </logger>                     

A clean-up thread runs every two hours that deletes inventory chunks larger than the configured permissible limit entry (by default, 1024). You will see the following log entry in orion.log two to three hours after inventory is pulled:

Performing delete for data type : SCORInventory

## Performing delete on n* autoIds 

Completed cleanup of large transactions from data channel for SCORInventory Data Type(s)

## This is the log that appears in conjunction with the above and below log messages when issue occurs.  n* can be any number greater than 1024

Cause

The log entries indicate the rows are deleted because the number of chunks for a single inventory exceeded the maximum permissible chunks limit of 1024.

Solution

Determine the XML chunk size:

On the ePO server:
Push the SC: Pull Inventory client task to the affected system.
 
On the Application Control client:

  1. Open Windows Explorer.
  2. Create a temporary folder (for example, C:\XMLs).
  3. Navigate to the C:\ProgramData\McAfee\Common Framework\AgentEvents folder.
  4. Copy all XML files that are approximately 60KB in size to the folder created in step 2.
  5. Click Start, Run, type cmd, and click OK to open a command prompt.
  6. Change directories to the folder created in step 2.
  7. Type the following command and press ENTER:
     
    findstr /C:TotalChunks *.*
     
  8. Find the value for the <TotalChunks> entry. 

    The following sample output file (20140710143850792763600000DF4.txml) has a chunk size of 2228.

    20140710143850792763600000DF4.txml:</Data><TotalChunks>2228</TotalChunks></SCORI
    nventory></SCORSoftware></SCORData>20140710143852118514000000DF4.txml:<?xml vers
    ion="1.0" encoding="UTF-8"?><SCORData><MachineInfo><MachineName>VWQSWOD00011</Ma
    chineName><AgentGUID>{9533B8FF-C3F7-45A0-9B83-CD85F68282F7}</AgentGUID><IPAddres
    s>10.186.30.46</IPAddress><OSName>Windows 2008 R2</OSName><UserName>SYSTEM</User
    Name><TimeZoneBias>-120</TimeZoneBias><RawMACAddress>005056b504bb</RawMACAddress
    ></MachineInfo><SCORSoftware ProductName="Solidifier" ProductVersion="6.1.3.353"
     ProductFamily="Secure"><SCORCommandResponse><EventID>20999</EventID><Severity>1
    </Severity><GMTTime>2014-07-10T12:38:52</GMTTime><TaskID>202</TaskID><Transactio
    nID>{ACB1847F-5518-44C9-AE5B-9FC07A5E82F3}</TransactionID><CommandExecuted>PullI
    nventory</CommandExecuted><SeqNo>2</SeqNo><Data xml:space="preserve">Success</Da
    ta><ReturnCode>0</ReturnCode><TotalChunks>2</TotalChunks></SCORCommandResponse><
    /SCORSoftware></SCORData>
Change the maximum permissible chunks per Solidcore endpoint Inventory:
  1. Open a browser and navigate to:

    https://<ePO_console_IP>:<ePO_port>/SOLIDCORE_META/updateInternalConfiguration.do

    NOTE:
    The path SOLIDCORE_META/updateInternalConfiguration.do is case sensitive.
     
  2. Type the ePO username and password.
  3. Type the following for Config Property Name:
     
    chunksLimitPerTranxToProcessInventory
    for Solidcore extensions up to 6.1.1
    chunksLimitPerTranxToProcessSCORInventory for Solidcore extension 6.1.2 or later
     
  4. Change Config Property Value to a value greater than the maximum number of chunks per inventory you determined earlier and click Update Property Value.
     
    NOTE: Increasing the property chunksLimitPerTranxToProcessInventory or chunksLimitPerTranxToProcessSCORInventory will use more memory. As a result, it may be necessary to increase the JvmMX value (see KB71516) if ePO performance is degraded. If you are running ePO 5.x and sufficient RAM is available, you can safely configure a high value for JvmMx without having any performance impact as it uses 64-bit JVM.

Rate this document

Languages:

This article is available in the following languages:

English United States
Japanese

Glossary of Technical Terms


 Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.