Knowledge Center

This article provides background information about how communication works between McAfee Agent and ePolicy Orchestrator (ePO), and provides some useful troubleshooting steps that you can take to diagnose communication failures. Agent-server communication is commonly abbreviated as ASCI. 

High-level overview of an ASCI work flow:
This section outlines the workflow for a successful ASCI session, and provides log file examples from the masvc_<MA_Client_Name>.log on the endpoint and the server_<ePO_Server_Name>.log on the McAfee ePO server. In the examples given, the name of the client is MAClient and the name of the McAfee ePO server is EPOServer. 

MA begins an ASCI session by collecting properties from all products installed on the endpoint. In this example MA is the only product installed on the endpoint.
masvc_MAClient.log on the endpoint shows:
 
Next, MA generates a Property Version (PropsVersion) consumed by ePO to determine if the client needs to send up a full property package, or if the incremental package sent by MA is acceptable. 
masvc_MAClient.log on the endpoint shows:
 

MA interrogates the MA.DB file which contains the list of available Agent Handlers (AH) and tries to connect to the AH with the highest priority.
masvc_MAClient.log on the endpoint shows:
 
The Agent Handler receives the props version and, if it is accepted, sends the client an HTTP 202 (accepted) response. Or, the handler might request that the client send up a full property package.
For example if the computer was deleted from the System Tree in ePO, it would have no properties and it would request MA to send up a full property package.
Server_EPOServer.log file example, on the Agent Handler shows the server accepting the incremental props:
 

MA then generates a Policy Manifest Request and sends it to the Agent Handler. The policy manifest is used by the AH to determine if the agent has up-to-date policies or if it needs a new policy package for one or more products.
masvc_MAClient.log on the endpoint shows:
 

McAfee Agent sends up any events which might be waiting to be forwarded to ePO. In this example, the endpoint log shows that no events are waiting to be forwarded.
masvc_MAClient.log on the endpoint shows:
 

Agent Handler reviews the Policy Manifest Request and provides its response to MA.

Server_EPOServer.log on the handler shows: McAfee Agent receives the response to the Policy Manifest Request in the form of a new policy package and ends the ASCI session.
masvc_MAClient.log on the endpoint shows:
 

Identifying ASCI failures in the masvc_<machinename>.log:

1. Open the masvc_<machinename>.log on the client failing the ASCI.
2. Navigate to the bottom of the log file.
3. Search for Agent is connecting to ePO Server.
4. Scroll down from this point and look for a log entry that shows MA trying to connect to a handler. It writes a few lines that are covered above. To view that section, click here.