Disabling DXL Broker, MAR Server, or TIE Server services can fail to remove the related TAG from the ePO system

Technical Articles ID: KB91043
Last Modified: 8/12/2021

Environment

McAfee Active Response (MAR) 2.x
McAfee Data Exchange Layer (DXL) 5.x, 4.x
McAfee Threat Intelligence Exchange Server (TIE Server) 2.x

Summary

On a fresh install of a consolidated server, you need to determine the services to be executed:

DXL Broker
TIE Server
MAR Server

If you decide to disable one of the services later, you must execute the script command change-services to redefine the server components.

At this point, any service that changed from Enabled to Disabled can lead to inconsistencies. The reason is because of McAfee ePO server tasks that detect installed products and set TAGs accordingly.

To avoid future issues, you must perform a series of steps both on the appliance and at the ePO console. See solutions 1, 2, or 3 below.

Solution 1

Disabling the DXL Broker service:

On the DXL system:
1. Run change-services command to switch off the DXL Broker.
2. Uninstall the rpm from the appliance. Execute the following command:
  
  rpm -e dxlbroker
Log on to the ePO Console.
Perform a full wake-up call
Check on ePO System Tree that DXL Broker product is no longer present on the Products tab.
From the ePO System Tree, select the system and remove the tag DXLBROKER.
Run the Server Task Manage DXL Brokers.
Perform a full wake-up call.
View the ePO System Tree.
- Make sure that the DXL Broker is no longer present on the Products tab.
- Check that the DXLBROKER tag has not been reassigned.
If all steps have been successful, verify the following:
- DXL Topology page (on McAfee ePO server Settings) does not show the server as an active broker.
- DXL Fabric page can show the removed broker as disconnected. But this display is fixed when all other brokers have updated their policies.
  This process can take up to an hour.

Solution 2

Disabling the MAR Server service:

On the MAR system, run the change-services command to switch off the MAR Server service.
Log on to the ePO Console.
In the ePO System Tree, select the system and remove the tag MARSERVER.
Navigate to ePO Registered Servers, and verify the server named Active Response Server points to the current MAR Server.
Run the following Server Task: Manage Active Response Servers
Perform a full McAfee Agent wake-up.
Check on ePO System Tree that the MAR Server is no longer present on the Products tab and the MARSERVER tag has not been reassigned.
If all steps have been successful, verify the following:
- DXL Fabric page services tab does not contain an entry for the disabled MAR Server.
- Active Response Health Status shows OK.

Solution 3

Disabling the TIE Server service:

On the TIE Server:
1. Switch off the TIE Server service:
  Type change-services and press Enter.
2. Uninstall rpm from the appliance by executing:
  
  rpm -e tieserver
Log on to the ePO Console.
Perform a full McAfee Agent wake-up.
Check the ePO System Tree and make sure that TIE Server product is no longer present on the Products tab.
In ePO System Tree, select the system and remove the tag TIESERVER.
Run the following Server Task:

Apply TIESERVER Tags to TIE Servers
Perform a full McAfee Agent wake-up.
View the ePO System Tree.
- Make sure that the TIE Server is no longer present on the Products tab.
- Make sure that the TIESERVER tag has not been reassigned.
If the environment contains bridged multi-ePO, run the following McAfee ePO server task on each server.

TIE Server Synchronize Topology
If all steps have been successful, verify the following:
- The DXL Fabric page services tab does not contain an entry for the disabled TIE Server.
- The TIE Topology page (on ePO Server Settings), does not show the disabled appliance as an active server.

Affected Products

Data Exchange Layer 6.x
Data Exchange Layer 5.x
Install/Uninstall
Known Issue/Product Defect
McAfee Active Response 2.x
Threat Intelligence Exchange Server 2.3.x
Threat Intelligence Exchange Server 2.2.x

Languages:

This article is available in the following languages:

English United States
Spanish Spain
French
Italian
Japanese
Portuguese Brasileiro

Knowledge Center

Disabling DXL Broker, MAR Server, or TIE Server services can fail to remove the related TAG from the ePO system

Environment

Summary

Solution 1

Solution 2

Solution 3

Affected Products

Languages:

Title

Title

Knowledge Center

Disabling DXL Broker, MAR Server, or TIE Server services can fail to remove the related TAG from the ePO system

Environment

Summary

Solution 1

Solution 2

Solution 3

Affected Products

Languages:

Choose your region

Title

Title