Sequence number invalid (McAfee Agent fails to connect to the ePO server)

Technical Articles ID: KB60776
Last Modified: 2023-06-06 09:36:33 Etc/GMT

Environment

ePolicy Orchestrator (ePO) 5.x
McAfee Agent (MA) 5.x

Problem 1

One or more of the following symptoms are present:

Clients are unable to contact the ePO server because their sequence number is lower than the server expects.
Computers using Deep Freeze don't connect to the ePO server.
Imaged computers don't connect to the ePO server.
Restoring VMware snapshots or images causes the agent to fail to connect to the ePO server.
Restoring Microsoft Virtual PC snapshots or images causes the agent to fail to connect to the ePO server.
Clients that share a McAfee Agent GUID fail to connect to the ePO server.

Problem 2

The Server.log records the errors below:

NAIMSERV servdal.cpp(1670): Agent <Hostname> with GUID {XXXXXXXXXX-XXXX} and IP and MAC has an invalid sequence number; expecting 68 > 176
NAIMSERV servdal.cpp(1757): Rejecting agent due to an invalid or duplicate sequence number
NAIMSERV ; AgentServerCommHandler.cpp(747): Failed to process agent request

The masvc_<computer_name>.log records the errors below:

masvc(2600.3368) ahclient.Info: Agent is connecting to ePO server
masvc(2600.3368) ahclient.Info: Initiating spipe connection to site https://1.2.3.4:443/spipe/pkg?AgentGuid={XXXXXXXXXX-XXXX&Source=Agent_3.0.0&TenantId=XXXXXXXXXX-XXXX.
masvc(2600.3368) ahclient.Info: connection initiated to site https://1.2.3.4:443/spipe/pkg?AgentGuid={XXXXXXXXXX-XXXX&Source=Agent_3.0.0&TenantId=XXXXXXXXXX-XXXX..
masvc(2600.3368) scheduler.Info: The task ma.event.priority.event.send.task.name is successful
masvc(2600.3368) scheduler.Info: Next time(local) of task ma.event.priority.event.send.task.name: 16:13:21
masvc(2600.3368) ahclient.Info: Network library rc = <1008>, Agent handler reports response code <503>.
masvc(2600.3368) ahclient.Info: Agent handler reports server busy. response code 503.
masvc(2600.3368) ahclient.Info: Spipe connection response received, network return code = 1008, response code 503.

System Change

You deployed MA through the ePO Server.

Cause

ePO uses an incremented sequencing algorithm to perform checks on client computers to prevent Replay Attacks. If agents communicate with the ePO server with a lower sequence number than it expects, the ePO server rejects the communication.

Sequence errors most commonly occur in the following situations:

When there are duplicate agent GUIDs
When computers are restored back to a previous setting. In other words, computers are restored to previous snapshots on a virtual machine that has an agent connected to an ePO server.

Solution

There are several ways for ePO administrators to find sequence error problems in the network.

For more information, see KB56086 - How to reset the McAfee Agent GUID if computers are not displayed in the ePolicy Orchestrator directory.

The ePO database contains an EPOAgentSequenceErrorLog table. This table contains the following fields that help ePO administrators track down systems with communication errors related to sequence check errors:

AutoID - A unique key for the table.
AutoGUID - The agent GUID of the agent that fails the sequence number check.
NodeName - The computer name that fails the sequence number check.
IPAddress - The IP address of the computer that fails the sequence number check.
MACAddress - The MAC address of the computer that fails the sequence number check.
TheTimestamp - The server time of the sequence number check failure.

To use the following features, add the line below to the [Server] section of Server.ini (located in C:\Program Files\McAfee\ePolicy Orchestrator\DB by default), and then restart the ePO services.

Feature Description	.INI File Addition	Examples
To set a limit to the sequence errors logged in the database on a per hour basis: ithout any value set, the default hourly limit for the number of sequence errors that are tracked in the database is 1,000. NOTE: Regardless of this setting, all sequence errors are logged in the server.log file. This setting is only for the database.	SequenceNumberErrorLogMaxErrorsPerHour	SequenceNumberErrorLogMaxErrorsPerHour=1000 SequenceNumberErrorLogMaxErrorsPerHour=0 NOTE: Setting this value to zero disables logging to the EPOAgentSequenceErrorLog table.
To set a history length in days for the sequence errors stored by the database: If missing from server.ini, the default time span for the error sequence history is seven days. The sequence error purge is run once at service startup, and then once every 24 hours. The purge removes the sequence errors from the EPOAgentSequenceErrorLog database table that are older than the defined time span.	SequenceNumberErrorLogHistDays	SequenceNumberErrorLogHistDays=1 SequenceNumberErrorLogHistDays=4 SequenceNumberErrorLogHistDays=90
To disable sequence error checking on the ePO server: NOTE: Disabling this feature is not recommended.	ConnectionsRequireValidSequenceNumber	ConnectionsRequireValidSequenceNumber=0

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

Sequence number invalid (McAfee Agent fails to connect to the ePO server)

Environment

Problem 1

Problem 2

System Change

Cause

Solution

Affected Products

Languages:

Title

Title

Knowledge Center

Sequence number invalid (McAfee Agent fails to connect to the ePO server)

Environment

Problem 1

Problem 2

System Change

Cause

Solution

Affected Products

Languages:

Choose your region

Title

Title