How to troubleshoot agent-server communication failures in McAfee Agent 5.x

This article provides background information about how communication works between McAfee Agent and ePolicy Orchestrator (ePO). It also provides some useful troubleshooting steps that you can take to diagnose communication failures. Agent-server communication is commonly abbreviated as ASCI. 

High-level overview of an ASCI workflow:
This section outlines the workflow for a successful ASCI session, and provides log file examples from the masvc_<MA_Client_Name>.log on the endpoint and the server_<ePO_Server_Name>.log on the McAfee ePO server. In the examples given, the name of the client is MAClient and the name of the McAfee ePO server is EPOServer. 

MA begins an ASCI session by collecting properties from all products installed on the endpoint. In this example, MA is the only product installed on the endpoint.
The log masvc_MAClient.log on the endpoint shows:
 
Next, MA generates a Property Version (PropsVersion) consumed by ePO to determine if the client needs to send up a full property package, or if the incremental package sent by MA is acceptable. 
The log masvc_MAClient.log on the endpoint shows:
 

MA interrogates the MA.DB file which contains the list of available Agent Handlers (AH) and tries to connect to the AH with the highest priority.
The log masvc_MAClient.log on the endpoint shows:
 
The Agent Handler receives the props version and, if it is accepted, sends the client an HTTP 202 (accepted) response. Or, the handler might request that the client send up a full property package.
For example if the computer was deleted from the System Tree in ePO, it would have no properties and it would request MA to send up a full property package.
Example: Server_EPOServer.log file on the Agent Handler shows the server accepting the incremental props:
 

MA then generates a Policy Manifest Request and sends it to the Agent Handler. The policy manifest is used by the AH to determine if the agent has up-to-date policies or if it needs a new policy package for one or more products.
The log masvc_MAClient.log on the endpoint shows:
 

McAfee Agent sends up any events which might be waiting to be forwarded to ePO. In this example, the endpoint log shows that no events are waiting to be forwarded.
The log masvc_MAClient.log on the endpoint shows:
 

Agent Handler reviews the Policy Manifest Request and provides its response to MA.

The log Server_EPOServer.log on the handler shows: McAfee Agent receives the response to the Policy Manifest Request in the form of a new policy package and ends the ASCI session.
The log masvc_MAClient.log on the endpoint shows:
 

Identifying ASCI failures in the masvc_<machinename>.log:

1. Open the masvc_<machinename>.log on the client failing the ASCI.
2. Navigate to the bottom of the log file.
3. Search for Agent is connecting to ePO Server.
4. Scroll down from this point and look for a log entry that shows MA trying to connect to a handler. It writes a few lines that are covered above. To view that section, click here.

Each problem section below highlights a specific error condition an ASCI session might fail, and gives some common causes and solutions. 

It is useful to note that MA uses the libcurl library to establish its connection to the Agent Handler, so many ASCI sessions fail with a curl error code.
For a complete list of CURL error codes, see https://curl.haxx.se/libcurl/c/libcurl-errors.html