Data Loss Prevention extension reports incorrect CPU system information

Technical Articles ID: KB94984
Last Modified: 2022-03-07 11:54:01 Etc/GMT

Environment

Data Loss Prevention (DLP) Endpoint
DLP Appliances Management Extension
ePolicy Orchestrator (ePO) 5.10 Update 8–12

Problem

When you review the DLP Appliance interface in the ePO Console, the CPU values are greatly exaggerated.

The CPU busy and idle values report percentages 100 times greater than they really are.

Examples:

The CPU idle value is reported to be 9800%
The CPU busy value is reported to be 100%

Inspection of the local device doesn’t report the same values. The values on the local device are much lesser than what is reported in ePO.

Examples of the actual CPU values reported on the device are as follows:

CPU idle value is 98%
CPU busy value is 1%

NOTE: You see this issue only in environments where the regional settings for the decimal symbol isn’t a period (.).

Cause

The event received from the DLP appliance reports the correct information to the ePO server.

The ePO server and Agent handlers contain an events.<number>.dll file. The file allows it to read and process inbound events from all managed products that the ePO server manages.

NOTES:

This file is installed as part of the ePOcore extension upgrade, which is performed as part of the ePO Update # upgrade process.
The file is updated during the ePO 5.10 Update process, but the updated file isn’t used.
Plug-in file location:
- <ePO install folder>/DB/plugins/EPOSRV_4000
- <Agent Handler install folder>/DB/plugins/EPOSRV_4000
As events are sent and received, the Agent Handler detects that the plug-in (DLL) is updated. Then, it replaces the previous older version.

Solution

This issue is resolved in ePO 5.10.0 Update 13, which is available from either the Software Catalog or the Product Downloads site.

NOTE: You need a valid Grant Number to access the update.

To view all resolved issues, see KB90382 - ePolicy Orchestrator 5.10.x Known Issues.

Workaround

To update the plug-in (dll file), review the current file EPOEVENTS.<number>.dll:

Open File Explorer.
Go to <ePO install folder>/DB/plugins/EPOSRV_4000
Right-click the file and select the Details tab
Note the modified date of the EPOEVENTS.<number>.dll.
Enter the URL below in the browser address bar:

https://localhost:8443/remote/epo.command.postInstallSQLConfig

NOTE: You can use the ePO server's IP address instead of localhost.
When you receive a prompt, enter your logon credentials. The screen updates and displays the message below:

OK:
True

Wait for one minute, and then recheck the file.
The file must read EPOEVENTS.<new number>.dll.

The Modified date entry must be different. If it isn’t, continue with the alternative steps below.

IMPORTANT: For environments with multiple Agent Handlers, verify that all Agent Handlers are updated.

If a new file doesn’t appear after one minute has passed, follow the steps below:

Shut down the McAfee Event Parser service:
1. Press Windows+R.
2. Type services.msc into the field and press Enter.
3. Right-click the ePO service below and click Stop:
  
  McAfee ePolicy Orchestrator 5.#.# Event Parser
Delete the DLLs in the folder:

<ePO install folder>/DB/plugins/EPOSRV_4000

<Agent Handler install folder>/DB/plugins/EPOSRV_4000.
Start the McAfee Event Parser service:
1. Right-click the ePO service below and click Start:
  
  McAfee ePolicy Orchestrator 5.#.# Event Parser
  
  3 Close the services window.
Recheck the EPOEVENTS.<number>.dll file.

The Modified date entry must be different.

IMPORTANT: For environments with multiple Agent Handlers, verify that all Agent Handlers are updated.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

Data Loss Prevention extension reports incorrect CPU system information

Environment

Problem

Cause

Solution

Workaround

Affected Products

Languages:

Title

Title

Knowledge Center

Data Loss Prevention extension reports incorrect CPU system information

Environment

Problem

Cause

Solution

Workaround

Affected Products

Languages:

Choose your region

Title

Title