Client tasks rerun after checking in an extension or product package that updates existing versions

Technical Articles ID: KB74420
Last Modified: 2023-01-05 14:57:51 Etc/GMT

Environment

Application and Change Control (ACC) 8.x, 7.x, 6.x

Endpoint Security (ENS) Threat Prevention 10.7.x, 10.6.x
Trellix Agent (TA) 5.x

NOTE: McAfee Agent was rebranded to Trellix Agent in version 5.7.7.

Problem 1

When you upgrade or reinstall Trellix Agent on a client system, or when you check in a new Trellix Agent extension on the ePO server:

Previously executed tasks that were configured to run immediately, execute again.

This issue also occurs when managed products linked to a deployment or update task are updated in the Master Repository. This action can cause:

Several products to be redeployed to clients if the deployment task was scheduled to run immediately.
Or
Updates to be deployed through update tasks.

Problem 2

When you check in a new product extension using the ePO console, previously executed tasks that were configured to run immediately, execute again.

This issue occurs when the existing managed product has an associated managed product task.

Cause

During a Trellix Agent extension upgrade, the taskroot version attribute in the database is modified. Based on the change that occurs during the upgrade process, the ePO server interprets this change to mean that the tasks have been modified. At the next scheduled Agent-to-Server Communication Interval (ASCI), the client receives the changes and reschedules the tasks for execution.

When a managed product is updated in the Master Repository, the taskroot version attribute is also updated. This action causes the agent to reschedule the task.

For example, suppose that an on-demand scan task is configured with the option Run Missed Task enabled. Trellix Agent would consider this task as missing its scheduled time and would trigger it to run.

Solution 1

This upgrade result is an expected behavior.

Disable the tasks that were configured for deployments, updates, or any other related tasks that might trigger.

Take the above actions before you upgrade the extension, manage a product, or the next ASCI occurs.

Solution 2

If you want a task to run only once, create a Run Client Task Now task in ePO. This type of task isn’t saved to the database. The agent creates the task after it receives the requirements from the ePO server and removes the task when completed.

NOTE: Use "run immediately" tasks conservatively and with small batches of systems. They consume data channel threads.

To create the task:

Log on to the ePO console.
Click System Tree.
Select the node where the task runs.
Click Actions, Agent, Run Client Task Now.
Select a Product and Task Type, and then click Create New Task.
Select task settings.
Click Run Task Now.

NOTE: You can view the progress in the ePO console.

Solution 3

When you check in new extensions for Endpoint Security, make sure that the configured on-demand scan tasks don’t have the option Run Missed Task enabled.

When enabled, this option prevents the on-demand scan task from running after the new extension is checked in. The same applies to any other managed product that has any managed product-related task.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

Client tasks rerun after checking in an extension or product package that updates existing versions

Environment

Problem 1

Problem 2

Cause

Solution 1

Solution 2

Solution 3

Affected Products

Languages:

Title

Title

Knowledge Center

Client tasks rerun after checking in an extension or product package that updates existing versions

Environment

Problem 1

Problem 2

Cause

Solution 1

Solution 2

Solution 3

Affected Products

Languages:

Choose your region

Title

Title