Data Collection - How to capture Apache -X output for troubleshooting Apache service issues
Last Modified: 2023-07-12 11:07:37 Etc/GMT
Affected Products
Languages:
This article is available in the following languages:
Trellix CEO, Bryan Palma, explains the critical need for security that’s always learning.
As per Gartner, "XDR is an emerging technology that can offer improved threat prevention, detection and response."
Trellix announced the establishment of the Trellix Advanced Research Center to advance global threat intelligence.
Trellix Advanced Research Center analyzes threat data on ransomware, nation-states, sectors, vectors, LotL, MITRE ATT&CK techniques, and emails.
As of May 14, 2024, Knowledge Base (KB) articles will only be published and updated in our new Trellix Thrive Knowledge space.
Log in to the Thrive Portal using your OKTA credentials and start searching the new space. Legacy KB IDs are indexed and you will be able to find them easily just by typing the legacy KB ID.
Data Collection - How to capture Apache -X output for troubleshooting Apache service issues
Technical Articles ID:
KB79646
Last Modified: 2023-07-12 11:07:37 Etc/GMT Environment
ePolicy Orchestrator (ePO) 5.x
Summary
When you see the Apache service fail to start periodically, you need an Apache -X output capture to provide more detailed logging and investigate further. This article provides information about how to capture the Apache -X output.
Problem 1
During ePO installation, the Apache service doesn't start, but the ePO installation completes. The ePO500CALog: Attempting to start Service [MCAFEEAPACHESRV]. ePO500CALog: ServiceStartService() failed to start service [MCAFEEAPACHESRV] with return code [-1]. Failed in InstallScript file [C:\CodeBases\isdev\Script\ISRT\Src\Service.rul] line number [316] with error code [1060]. ePO500CALog: FAILURE: Unable to start service [MCAFEEAPACHESRV] ePO500CALog: Service MCAFEETOMCATSRV500 is running ePO500CALog: Verifying that MCAFEEAPACHESRV has started ePO500CALog: Loading the following DLL for Use: [C:\Users\UNIT9A~1\AppData\Local\Temp\{424FEB85-17D9-4372-BB4F-52B8C004E70D}\CommonSetup.DLL] ePO500CALog: Setting the current directory to [C:\Users\UNIT9A~1\AppData\Local\Temp\{424FEB85-17D9-4372-BB4F-52B8C004E70D}]. ePO500CALog: FAILURE: Timeout while waiting for service event to trigger. Problem 2
The "C:\Program Files (x86)\McAfee\ePolicy Orchestrator\Apache2\bin\Apache.exe" Return code: 1 Error Message: Incorrect function. Solution
Capture Apache -X output:
If the Apache service is in a running state: An Apache -X output is sometimes captured when Apache is in a running state. You also see information similar to the following: [Wed Jan 02 08:22:05 2013] [notice] Disabled use of AcceptEx() WinSock2 API (OS 10048)Only one usage of each socket address (protocol/network address/port) is normally permitted. : make_sock: could not bind to address [::]:81 (OS 10048)Only one usage of each socket address (protocol/network address/port) is normally permitted. : make_sock: could not bind to address 0.0.0.0:81 no listening sockets available, shutting down Unable to open logs Br /> \McAfee\ePolicy Orchestrator\Apache2\bin>Apache.exe -X [Wed Jan 02 08:22:23 2013] [notice] Disabled use of AcceptEx() WinSock2 API I 6868 MFEFIPS Loading: "D:\PROGRA~2\McAfee\EPOLIC~1", Role = Officer, Mode = Normal I 6868 MFEFIPS Module Initialized. I 6868 NAIMSERV Allocating space for 9 simultaneous agent properties packages. I 6868 NAIMSERV Initializing server... I 6868 NAIMSERV Database initialization: Starting. I 6868 MFEFIPS Loading: "D:\PROGRA~2\McAfee\EPOLIC~1", Role = Officer, Mode = Normal I 6868 MFEFIPS Module Initialized. I 6868 EPODAL Using SQL Authentication for [ePO-Hostname,Port].[ePO-Databasename] I 6868 EPODAL Successfully initialized database access for [ePO-Hostname, Port].[ePO-Databasename] I 6868 NAIMSERV Database initialization: Succeeded. I 6868 NAIMSERV Policy Manager initialization: Starting. I 6868 EPODAL Successfully initialized database access for [ePO-Hostname, Port].[ePO-Databasename] I 6868 NAIMSERV Policy Manager initialization: Succeeded. I 6868 NAIMSERV Server state at startup: Enabled I 6868 NAIMSERV ePolicy Orchestrator configured to run in single-tenant mode. I 6868 MFEFIPS Loading: "D:\PROGRA~2\McAfee\EPOLIC~1", Role = Officer, Mode = Normal I 6868 MFEFIPS Module Initialized. I 6868 NAIMSERV Checking to see if the ePO server is available. We will try 12 times. I 6868 NAIMSERV The Agent Handler successfully connected to the ePO server. I 6868 NAIMSERV Unloading server private keys I 6868 NAIMSERV ePolicy Orchestrator server started. I 6868 MOD_EPOREPO Database initialization: Starting. I 6868 MOD_EPOREPO Database initialization: Succeeded. I 3624 NAIMSERV LdapSync: Status changed: Offline I 3624 NAIMSERV Deleting apache/tomcat log file errorlog.2013-10-20 To stop Apache -X, press CTRL+C. The following displays when Apache-X stops: I 6868 NAIMSERV Shutting down server... I 6868 NAIMSERV Waiting for DALPing thread exit I 6868 NAIMSERV DALPing thread exited I 6868 NAIMSERV Waiting for Perfmon thread exit I 6868 NAIMSERV Perfmon thread exited I 6868 NAIMSERV Releasing File Locks... I 6868 NAIMSERV Cleaning up temp directory... I 6868 NAIMSERV ePolicy Orchestrator server stopped. I 6868 MFEFIPS Module Shutdown Complete Affected ProductsLanguages:This article is available in the following languages: |
|