Agent Handler reports response code 404
Last Modified: 2022-03-18 20:42:28 Etc/GMT
Affected Products
Languages:
This article is available in the following languages:
Trellix CEO, Bryan Palma, explains the critical need for security that’s always learning.
As per Gartner, "XDR is an emerging technology that can offer improved threat prevention, detection and response."
Trellix announced the establishment of the Trellix Advanced Research Center to advance global threat intelligence.
Trellix Advanced Research Center analyzes threat data on ransomware, nation-states, sectors, vectors, LotL, MITRE ATT&CK techniques, and emails.
As of May 14, 2024, Knowledge Base (KB) articles will only be published and updated in our new Trellix Thrive Knowledge space.
Log in to the Thrive Portal using your OKTA credentials and start searching the new space. Legacy KB IDs are indexed and you will be able to find them easily just by typing the legacy KB ID.
Agent Handler reports response code 404
Technical Articles ID:
KB92556
Last Modified: 2022-03-18 20:42:28 Etc/GMT EnvironmentMcAfee Agent (MA) 5.x
Problem
Apache service on the ePO Server responds with a 404 message. This message means that the ePO Server module is not running, even though the Apache service is functioning. The following error is recorded in the masvc(4456.5060) ahclient.Info: Network library rc = <1008>, Agent handler reports response code <404>. masvc(4456.5060) ahclient.Info: Agent handler reports file not found. response code 404 The E #06204 NAISIGN naisign.cpp(3508): Completed enumeration of windows cert store, cert matching name 'AH_USASH-AV1' not found. Result=0x80000008 E #06204 NAIMSERV common\AgentHandlerKeyService.cpp(186): Failed to decrypt using the certificate. E #06204 NAIMSERV D:\BUILD_817067\BUILD\ePO\dev\src\server\include\Unobfuscate.inl(105): Unable to load asymmetric key E #06204 NAIMSERV common\ApacheTomcatUser.cpp(82): Failed to encrypt for auth URI, res 0x80000003 E #06204 NAIMSERV servinit.cpp(575): Failed to get create Apache to Tomcat user(2) E #06204 MCUPLOAD SecureHttp.cpp(863): Failed to query auth schemes (error=4317) W #06204 NAIMSERV The Agent Handler failed to connect to the ePO server. I #06204 NAIMSERV Failed to connect to the ePO server. The Agent Handler does not require the ePO server to be running, but it will exchange information if it is running. I #06204 NAIMSERV Shutting down server... I #06204 NAIMSERV Shutting down syslog forward subsystem E #06204 NAIMSERV SyslogForwarder.cpp(509): Syslog thread did not respond to shutdown signal, forcing... I #06204 NAIMSERV Releasing File Locks... I #06204 NAIMSERV Cleaning up temp directory... I #06204 NAIMSERV ePolicy Orchestrator server stopped. On the ePO Server, the Windows Certificate Store contains the Agent Handler certificate for the host name Subject: CN=AH_USSTG-AV1, OU=ePO, O=McAfee Issuer: CN=AH_CA_USSTG-AV1, OU=AH, O=McAfee Thumbprint: B69AB5762BE6DF73A832EF4C640B21520CF08712 FriendlyName : mykey NotBefore: 1/1/1970 12:00:00 AM NotAfter: 5/31/2048 10:18:36 AM Extensions: {System.Security.Cryptography.Oid Subject: CN=WMSvc-USSTG-AV1 Issuer: CN=WMSvc-USSTG-AV1 Thumbprint: 6F7CD440C19D41E37AF1FB57544996459BC33E60 FriendlyName: NotBefore : 3/10/2012 7:30:46 AM NotAfter: 3/8/2022 7:30:46 AM Extension{System.Security.Cryptography.Oid Cause
The host name on ePO server has changed. The host name in the windows certificate store for the Agent Handler certificate is different from the host name of ePO Server. Example: Server name changed from The Example Solution
You must regenerate the Agent Handler certificate using the details in KB90760.
Affected ProductsLanguages:This article is available in the following languages: |
|