Collecte des données pour les problèmes de Endpoint Security pour Mac et Endpoint Protection for Mac

This article provides the required data collection and troubleshooting steps for issues related to ENSM.

Contents
Click to expand the section you want to view:

Installation issue

Collect the following data for an ENSM installation issue either through an ePolicy Orchestrator installation task or a standalone installation.

Data collection steps:

Collect McAfee Agent Minimum Escalation Requirements (MER) output. For instructions, see KB86785 - How to use the McAfee Agent MER tool for Mac.
Collect ENSM MER output. For instructions, see KB87626 - Collect Minimum Escalation Requirements for ENSM or VSMAC.

Menulet or dashboard shows "Your Mac At Risk" and the Functional Module Platform (FMP) status is "Not working"

Perform the following troubleshooting steps and collect the following data if the menulet or dashboard shows "Your Mac At Risk" and the FMP status shows "Not working".

Troubleshooting and data collection steps:

Check whether the FMP service is running from Activity Monitor. Or, run the following command from a terminal:

/usr/local/McAfee/fmp/bin/fmp status
- If the FMP service is not running:
  1. Check the console log and see whether the process is crashing. If the process is crashing, check the reason for the crash in the crash log.
  2. Start the service using the following command from a terminal:
    
    /usr/local/McAfee/fmp/bin/fmp start
  3. Wait for 30 seconds to one minute and check whether the FMP process started.
- If the FMP service is running:
  1. Restart the service using the following commands from a terminal:
    
    /usr/local/McAfee/fmp/bin/fmp stop
    /usr/local/McAfee/fmp/bin/fmp start
  2. Wait for 30 seconds to one minute and check whether the FMP process started.
Check whether any process is crashing. If a process is crashing, check the reason for the crash in the crash log.
Run the repairMSC utility available at /usr/local/McAfee. This utility captures MER output to the user's home folder. Check whether the problem is resolved.
Check for any error messages in /var/log/system.log, /var/log/McAfeeSecurity.log, and Console.log.
Restart the system. Check whether the problem is resolved.
Uninstall ENSM and then reinstall ENSM. Check whether the problem is resolved.

If the problem is still not resolved, send the MER output with the above investigation results.

Product functionality issue

Collect the following data for an issue with ENSM product functionality.

Data collection steps:

Enable debug logging for the ENSM module that has the issue. For example, if there is an issue with the ENSM Threat Prevention module, enable debug logging for the ENSM Threat Prevention module.
Reproduce the issue.
Collect MER output after reproducing the issue.

System crash

For a system crash, update to the latest ENSM build if possible and check whether the issue is resolved. If not, collect the following data.

Data collection steps:

Reproduce the system crash.
Collect MER output.
Collect the system crash report from: ~/Library/Logs/DiagnosticReports/

Performance issue

Most performance issues are related to Threat Prevention on-access scan.

Troubleshooting and mitigation steps:

Make sure that Scan Archive is disabled for on-access scan.
Run a "ZZZ" test and check whether the performance issue can be resolved. For instructions, see KB89757 - Troubleshoot performance issues with Threat Prevention. If performance is acceptable, an on-access scan exclusion should resolve the issue.
If the performance issue is related to an application, try adding an on-access scan exclusion for the application folders and files.

Data collection steps:

Enable debug logging.
Reproduce the performance issue.
Collect MER output after reproducing the issue.

Other data, such as a system diagnostic report and a spindump, might be needed on a case-by-case basis when debugging ENSM performance issues.

Collect the system diagnostic report from the system:
1. Open a terminal on the system.
2. Run the following command:
  
  sysdiagnose -f <path where the file should be stored>
  
  When the command is successful, a file is created in the path provided. The file name would look similar to:
  
  sysdiagnose_2019.02.11_19-15-41+0530_<hardware model>_<macOS build number>.tar.gz
Collect a spindump:
To generate the spindump, follow the instructions in this Apple article.

Other issues

For other issues not mentioned above, enable debug logging and collect MER output.

Knowledge Center

Data collection for issues with Endpoint Security for Mac

Environnement

Synthèse

Informations connexes

Produits affectés

Langues :

Glossaire des termes techniques

Title

Title

Knowledge Center

Data collection for issues with Endpoint Security for Mac

Environnement

Synthèse

Informations connexes

Produits affectés

Langues :

Glossaire des termes techniques

Choisissez votre région

Title

Title