Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
cancel

Mcafee 8.0 and CSA Conflict, CCM 4.1(3)sr3a

I am seeing a conflict between McAfee VirusScan Enterprise v8.0.0 patch version 1 and CSA v4.5.1 build 639.

When the network associates McShield service starts when CSA is started , the McShield service terminates unexpectedly a couple dozen times. This is causing other cisco call manager related services to get briefly hung up on the server also.

If I stop CSA, then start McShield, then start CSA after McShield is started all appears to be fine.

I have done several bug searches and come up empty, and found 2-3 previous forum posts on this issue with same symptons but no fix. Planning on applying latest CSA on call manager but can't find anything yet that confirms a newer CSA fixes this or not.

Event Type: Information

Event Source: CSAgent

Event Category: Local Event Mgr

Event ID: 256

Date: 5/24/2006

Time: 12:02:40 AM

User: N/A

Computer: CCM

Description:

[2006-05-24 00:02:40.575] [PID=8208] [AgentUI]: listener_th: It took too long (88672 millisec) to process event with code=650: type=EVTM EvSrcComp=6 EvDstComp=4 EvCode=AUI_AGENT_STATUS_UPDATE

Event Type: Information

Event Source: CSAgent

Event Category: Local Event Mgr

Event ID: 256

Date: 5/24/2006

Time: 12:03:00 AM

User: N/A

Computer: CCM

Description:

[2006-05-24 00:03:00.826] [PID=8208] [AgentUI]: DIPC_get_unique: Failed to write to comp Csamanager on fixed channel Global\Csamanager_ch_00000000: 3006

Then the service terminated....... this is having effecting on cisco services stopping starting, or server getting hung-up briefly until it recovers.

Event Type: Error

Event Source: Service Control Manager

Event Category: None

Event ID: 7031

Date: 5/24/2006

Time: 12:02:42 AM

User: N/A

Computer: CCM1

Description:

The Network Associates McShield service terminated unexpectedly. It has done this 26 time(s). The following corrective action will be taken in 0 milliseconds: No action.

8 REPLIES

Re: Mcafee 8.0 and CSA Conflict, CCM 4.1(3)sr3a

Just in case you haven't seen this, here is the configuration document for 8.0 on CM. They do recommend some settings in McAfee.

http://www.cisco.com/en/US/products/sw/voicesw/ps556/prod_bulletin0900aecd800f617e.html

I'm not sure if these settings affect the CSA but you might want to verify they are applied.

Thanks

Fred

Re: Mcafee 8.0 and CSA Conflict, CCM 4.1(3)sr3a

The McAfee settings match those in the cisco doc.

Blue

Re: Mcafee 8.0 and CSA Conflict, CCM 4.1(3)sr3a

We had problems with McAfee for some time after we deployed VSE 8.0i in March 2005 (we also replaced it with another product in November last year).

I found that the McAfee TDI driver was competing with the CSA TDI driver. Disabling the McAfee driver helped eliminate the timeout and service failure errors and it's not needed because CSA fulfils that function).

Don't know if it applies in your case but here is the reg setting:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NaiAvTdi1]

"Start"=dword:00000004

Some of the later patches may help performance. They are up to patch 12 I think...

HTH

Tom S

Re: Mcafee 8.0 and CSA Conflict, CCM 4.1(3)sr3a

Thanks for the tip, we are having same problem with the current CSA version (version 4.51 build 645) also which makes sense based on the TDI driver comment. Will see about doing that.

Also, with the newer CSA version we're only seeing the one CSAgent event log entry instead of the two.

Event Type: Information

Event Source: CSAgent

Event Category: Local Event Mgr

Event ID: 256

Date: 5/24/2006

Time: 12:02:40 AM

User: N/A

Computer: CCM

Description:

[2006-05-24 00:02:40.575] [PID=8208] [AgentUI]: listener_th: It took too long (88672 millisec) to process event with code=650: type=EVTM EvSrcComp=6 EvDstComp=4 EvCode=AUI_AGENT_STATUS_UPDATE

Blue

Re: Mcafee 8.0 and CSA Conflict, CCM 4.1(3)sr3a

A couple of thoughts...

You may want to check and see if there are other services competing with CSA when this happens (like at startup or login).

We turned off some busy services (Computer Browser, Messenger, SSDP) and it helped. It also seemed like multihomed systems were more susceptible. Laptops with wired and wireless enabled (though the wireless was not connected) and dual NIC servers with both enabled but only one connected.

You could also try and increase the polling interval and check and see if some rules are set to check if the MC is reachable or not.

This might take some pressure off the host agents and reduce the number of timeouts.

Re: Mcafee 8.0 and CSA Conflict, CCM 4.1(3)sr3a

The mcafee tdi registry settings had no effect on the system I am working with.

I have narrowed it down to CSA and McAfee McShield service conflicting as after servers been up awhile, everytime I start McShield with CSA running it runs for a minute or so then the McShield service crashes. I have also tried to stop other non-critical services and same thing that are running. So there is a conflict and it's not just on boot up.

Re: Mcafee 8.0 and CSA Conflict, CCM 4.1(3)sr3a

Updating mcafee enterprise 8.0i from patch 1 to patch 11 has resolved this issue it looks like. So far so good and have tried to recreate issue with patch 11 and can not.

Community Member

Re: Mcafee 8.0 and CSA Conflict, CCM 4.1(3)sr3a

Have had the same problem and in my case I used patch 13 for Mcafee and it works fine...

236
Views
4
Helpful
8
Replies
CreatePlease to create content