There's no separate event ID for the mfetpd service start/stop. But, the following workaround can help determine the status of the mfetpd service.

Enable the on-access scan start/stop event IDs in ePO:

1. In the ePO console, navigate to Server Settings, Event Filtering.
2. Edit Event Filtering and select the option The agent forwards: Only selected events to the server.
3. Select the following Event IDs:
   • 1087: On-access scan started (Info)
   • 1088: On-access scan stopped. (Info)

Below is the sequence when the mfetpd service gets stopped locally on the system. You can find these entries in /var/McAfee/ens/log/tp/mfetpd.log (with debug logging enabled).

INFO ENSLMain [20454] Product has started the shutdown sequence
INFO AccessProtection [20454] Access protection rules saved successfully
DEBUG AccessProtection [20454] Exploit prevention is enabled, so AAC interface wrapper will not be deinitialized
DEBUG AccessProtection [20454] Access Protection is disabled
DEBUG ENSLMain [20454] MessageBus thread has joined back
INFO TaskManager [20454] Task - Default Client Update task is not running
DEBUG AMOASBroker [20454] Stop OAS watchdog triggered. Exiting OAS watchdog thread
DEBUG AMManageFAEvent [20454] Received event from File Access library with an empty file path.
DEBUG AMManageFAEvent [20454] Exiting the Consume Scan Request Queue loop.
DEBUG AMManageFAEvent [20454] Stopped monitoring Scan Requests
INFO AMOASBroker [20454] Scan Cache is being cleared as OAS is being stopped
DEBUG ScanFactoryBroker [20454] Removing the whitelisting of the OAS Manager PID from the file initialization library - 20498
DEBUG AMEventAdaptor [20454] Successfully sent ePO event - 1088
DEBUG ConfigController [20454] DNDGTISelectionCriteria.GTIThrottling.NumHitsToday key is already set to same value. Hence not setting it again to same value
DEBUG ConfigController [20454] DNDGTISelectionCriteria.GTIThrottling.NumConsumedQuota key is already set to same value. Hence not setting it again to same value
DEBUG ConfigController [20454] DNDGTISelectionCriteria.LastGTIParamsUpdate key is already set to same value. Hence not setting it again to same value
DEBUG ConfigController [20454] DNDProductInformation.DaysSinceInstallation key is already set to same value. Hence not setting it again to same value
DEBUG GTIQueryManager [20454] Disabling GTI query manager and GTI reachability
DEBUG ESPUtils [20454] Failed to open CPU quota configuration file
DEBUG AMManageFAEvent [20454] Stopped monitoring Scan Responses and stopped File Access hooking
INFO ScanFactoryBroker [20454] Scan Factory child process exited normally
INFO ScanFactoryBroker [20454] Scan Factory Process was stopped successfully
DEBUG AMODSBroker [20454] Checking if this task needs to be stopped - quick scan
DEBUG AMODSBroker [20454] Checking if this task needs to be stopped - full scan
INFO ExploitPrevention [20454] Exploit Prevention combined rules saved successfully
DEBUG ExploitPrevention [20454] Access Protection is enabled, so AAC interface wrapper will not be deinitialized
DEBUG ExploitPrevention [20454] Exploit Prevention is disabled
INFO MsgBusPolicyNotificationHandler [20454] Unregistration of Policy Enforcement Notification handler was successful
INFO MsgBusPropertyCollectionProv [20454] Unregistration of Property Collection Provider was successful
INFO MsgBusPolicyNotificationHandler [20454] Unregistration of Policy Enforcement Notification handler was successful
INFO MsgBusTaskEnforcementHandler [20454] Unregistration of Task Enforcement Handler was successful
DEBUG MsgBusAgentUpdateServiceHandler [20454] Unregistration of Agent Update Handler was successful
INFO MsgBusInfEvHand [20454] Unregistration of Information Event handler was successful
INFO ma_client [20454] stopping ma client.
INFO msgbus [20454] Unregistered for msgbus connectivity resync
INFO msgbus [20454] Removed file watcher on broker config file
INFO dispatcher [20454] dispatcher dl_close 0x7fa9300078a0
INFO dispatcher [20454] dispatcher dl_close 0x7fa930007d70
INFO ma_client [20454] stopping ma client notifier thread.
INFO ma_client [20454] ma config monitor stop received.
INFO ma_client [20454] ma client notifier thread existing...
DEBUG RegistrationCallback [20454] Successfully sent a deregistration request to ESP
INFO ENSLMain [20454] Product has completed the shutdown sequence

If the on-access scan start/stop event IDs aren't selected in ePO, mfetpd.log contains the following line:

DEBUG MsgBusEventReporterImpl [14880] Event could not be created since event id is disabled by policy - 1088

When the mfetpd service gets stopped, event 1088 gets generated and sent to ePO. You can see event 1088 in the ePO Threat Event Log:

• Event ID: 1088
• Event Description: On-access scan stopped
• Event Category: Scan ended

The Event Details page shows the following for event 1088:

• Event Category: Scan ended
• Event ID: 1088
• Threat Severity: Information
• Threat Name: None
• Threat Type: None
• Action Taken: None
• Threat Handled: True
• Analyzer Detection Method: OAS
• Event Description: On-access scan stopped.

NOTES:

• ​The following events under Event Filtering aren't applicable to ENSL:
  • 1064: Service was started (Info)
  • 1065: Service ended (Info)
• A successful DAT update stops and starts the on-access scanner. So, events 1087 and 1088 are generated accordingly (normally daily). But, once the mfetpd service is stopped, the DAT fails to update. So, only event 1088 (generated at the time of service stop) is seen in ePO.