没有针对以下情况的独立事件 ID
mfetpd 服务启动/停止。但是，以下解决方法可帮助确定
mfetpd 服务。
启用 ePO 中的按访问扫描开始/停止事件 Id：
- 在 ePO 控制台中，导航到 服务器设置， 事件过滤
。
- 编辑 事件过滤
并选择 "" 选项 代理将转发：仅选定的事件到服务器。
- 选择以下事件 Id：
- 1087：已启动按访问扫描（信息）
- 1088：已停止按访问扫描。间隔
以下是该序列的
mfetpd 服务已在系统上本地停止。您可以在以下位置找到这些条目
/var/McAfee/ens/log/tp/mfetpd.log （包含调试日志记录启用）。
INFO ENSLMain [20454] Product has started the shutdown sequence
INFO AccessProtection [20454] Access protection rules saved successfully
DEBUG AccessProtection [20454] Exploit prevention is enabled, so AAC interface wrapper will not be deinitialized
DEBUG AccessProtection [20454] Access Protection is disabled
DEBUG ENSLMain [20454] MessageBus thread has joined back
INFO TaskManager [20454] Task - Default Client Update task is not running
DEBUG AMOASBroker [20454] Stop OAS watchdog triggered. Exiting OAS watchdog thread
DEBUG AMManageFAEvent [20454] Received event from File Access library with an empty file path.
DEBUG AMManageFAEvent [20454] Exiting the Consume Scan Request Queue loop.
DEBUG AMManageFAEvent [20454] Stopped monitoring Scan Requests
INFO AMOASBroker [20454] Scan Cache is being cleared as OAS is being stopped
DEBUG ScanFactoryBroker [20454] Removing the whitelisting of the OAS Manager PID from the file initialization library - 20498
DEBUG AMEventAdaptor [20454] Successfully sent ePO event - 1088
DEBUG ConfigController [20454] DNDGTISelectionCriteria.GTIThrottling.NumHitsToday key is already set to same value. Hence not setting it again to same value
DEBUG ConfigController [20454] DNDGTISelectionCriteria.GTIThrottling.NumConsumedQuota key is already set to same value. Hence not setting it again to same value
DEBUG ConfigController [20454] DNDGTISelectionCriteria.LastGTIParamsUpdate key is already set to same value. Hence not setting it again to same value
DEBUG ConfigController [20454] DNDProductInformation.DaysSinceInstallation key is already set to same value. Hence not setting it again to same value
DEBUG GTIQueryManager [20454] Disabling GTI query manager and GTI reachability
DEBUG ESPUtils [20454] Failed to open CPU quota configuration file
DEBUG AMManageFAEvent [20454] Stopped monitoring Scan Responses and stopped File Access hooking
INFO ScanFactoryBroker [20454] Scan Factory child process exited normally
INFO ScanFactoryBroker [20454] Scan Factory Process was stopped successfully
DEBUG AMODSBroker [20454] Checking if this task needs to be stopped - quick scan
DEBUG AMODSBroker [20454] Checking if this task needs to be stopped - full scan
INFO ExploitPrevention [20454] Exploit Prevention combined rules saved successfully
DEBUG ExploitPrevention [20454] Access Protection is enabled, so AAC interface wrapper will not be deinitialized
DEBUG ExploitPrevention [20454] Exploit Prevention is disabled
INFO MsgBusPolicyNotificationHandler [20454] Unregistration of Policy Enforcement Notification handler was successful
INFO MsgBusPropertyCollectionProv [20454] Unregistration of Property Collection Provider was successful
INFO MsgBusPolicyNotificationHandler [20454] Unregistration of Policy Enforcement Notification handler was successful
INFO MsgBusTaskEnforcementHandler [20454] Unregistration of Task Enforcement Handler was successful
DEBUG MsgBusAgentUpdateServiceHandler [20454] Unregistration of Agent Update Handler was successful
INFO MsgBusInfEvHand [20454] Unregistration of Information Event handler was successful
INFO ma_client [20454] stopping ma client.
INFO msgbus [20454] Unregistered for msgbus connectivity resync
INFO msgbus [20454] Removed file watcher on broker config file
INFO dispatcher [20454] dispatcher dl_close 0x7fa9300078a0
INFO dispatcher [20454] dispatcher dl_close 0x7fa930007d70
INFO ma_client [20454] stopping ma client notifier thread.
INFO ma_client [20454] ma config monitor stop received.
INFO ma_client [20454] ma client notifier thread existing...
DEBUG RegistrationCallback [20454] Successfully sent a deregistration request to ESP
INFO ENSLMain [20454] Product has completed the shutdown sequence
如果未在 ePO 中选择按访问扫描开始/停止事件 Id，
mfetpd.log 包含以下行：
DEBUG MsgBusEventReporterImpl [14880] Event could not be created since event id is disabled by policy - 1088
当
mfetpd 服务停止时，系统会生成事件1088并将其发送给 ePO。您可以在 ePO 威胁事件日志中看到事件1088：
- 事件 ID：1088
- 事件描述：已停止按访问扫描
- 事件类别：扫描已结束
事件详细信息页面显示了事件1088的以下内容：
- 事件类别：扫描已结束
- 事件 ID：1088
- 威胁严重性：信息
- 威胁名称：无
- 威胁键入：无
- 操作：无
- 已处理的威胁： True
- 分析器检测方法： OAS
- 事件描述：已停止按访问扫描。
注意：
- 以下事件 事件过滤
不适用于 ENSL：
- 1064：已启动服务（信息）
- 1065：服务已结束（信息）
- 成功的 DAT 更新会停止并启动按访问扫描程序。因此，事件1087和1088会相应生成（通常为每天）。但是，一旦 mfetpd 服务已停止，无法更新 DAT。因此，在 ePO 中只会显示事件1088（在停止服务时生成）。
