EventParser service fails to start after installation of ePO 5.10 Update 13
Last Modified: 2023-03-13 15:12:13 Etc/GMT
Affected Products
Languages:
This article is available in the following languages:
Trellix CEO, Bryan Palma, explains the critical need for security that’s always learning.
As per Gartner, "XDR is an emerging technology that can offer improved threat prevention, detection and response."
Trellix announced the establishment of the Trellix Advanced Research Center to advance global threat intelligence.
Trellix Advanced Research Center analyzes threat data on ransomware, nation-states, sectors, vectors, LotL, MITRE ATT&CK techniques, and emails.
As of May 14, 2024, Knowledge Base (KB) articles will only be published and updated in our new Trellix Thrive Knowledge space.
Log in to the Thrive Portal using your OKTA credentials and start searching the new space. Legacy KB IDs are indexed and you will be able to find them easily just by typing the legacy KB ID.
EventParser service fails to start after installation of ePO 5.10 Update 13
Technical Articles ID:
KB95813
Last Modified: 2023-03-13 15:12:13 Etc/GMT Environment
ePolicy Orchestrator (ePO) 5.10 Update 13
Summary
The ePO DB driver upgrades to The Cumulative Update (CU) 13 package is bundled with Problem
The EventParser service doesn't start after the installation of ePO 5.10 CU 13. The errors below are recorded in the ERROR: The system was unable to find the specified registry key or value. 2022-06-09T00:48:23.062Z - info: ***arg list for unblock msoledb msi*** 0=-Command, 1=Unblock-file, 2='C:\Users\RGC\Desktop\ePO_5.10.0_Update_13\resources\app\MSOLEDB\msoledbsql_x64.msi' 2022-06-09T00:48:24.986Z - info: Successfully unlock the MSOLEDB msi file. 2022-06-09T00:48:24.986Z - info: ***arg list for installing msoledb driver*** 0=/q, 1=IACCEPTMSOLEDBSQLLICENSETERMS=YES, 2=/L*V, 3="%TEMP%\msoledbsql_x64_Inst.Log", 4=/norestart 2022-06-09T00:59:19.956Z - info: stdout for MSOLEDB: 2022-06-09T00:59:19.956Z - info: MSOLEDB driver installation failed 2022-06-09T00:59:19.975Z - info: Query execution failedConnectionError: Failed to connect to RGCEPO:1433 - read ECONNRESET 2022-06-09T00:59:19.975Z - info: Update with Id CU-13 is not installed on this system, start installing The MSI (c) (BC:78) [12:16:05:042]: Resetting cached policy values MSI (c) (BC:78) [12:16:05:042]: Machine policy value 'Debug' is 0 MSI (c) (BC:78) [12:16:05:042]: ******* RunEngine: ******* Product: C:\Users\RGC\Desktop\ePO_5.10.0_Update_13\resources\app\MSOLEDB\msoledbsql_x64.msi ******* Action: Property(S): ProductToBeRegistered = 1 Property(S): ReplacedInUseFiles = 1 MSI (s) (44:EC) [12:16:37:299]: Note: 1: 1707 MSI (s) (44:EC) [12:16:37:300]: Product: Microsoft OLE DB Driver for SQL Server -- Installation completed successfully. MSI (s) (44:EC) [12:16:37:301]: Windows Installer installed the product. Product Name: Microsoft OLE DB Driver for SQL Server. Product Version: 18.6.3.0. Product Language: 1033. Manufacturer: Microsoft Corporation. Installation success or error status: 0. MSI (s) (44:EC) [12:16:37:302]: Value of RebootAction property is MSI (s) (44:EC) [12:16:37:302]: Windows Installer requires a system restart. Product Name: Microsoft OLE DB Driver for SQL Server. Product Version: 18.6.3.0. Product Language: 1033. Manufacturer: Microsoft Corporation. Type of System Restart: 2. Reason for Restart: 1. MSI (s) (44:EC) [12:16:37:303]: Product: Microsoft OLE DB Driver for SQL Server. Restart required. The installation or update for the product required a restart for all changes to take effect. The restart was deferred to a later time. MSI (s) (44:EC) [12:16:37:341]: Deferring clean up of packages/files, if any exist MSI (s) (44:EC) [12:16:37:342]: MainEngineThread is returning 3010 MSI (s) (44:60) [12:16:37:400]: RESTART MANAGER: Session closed. MSI (s) (44:60) [12:16:37:400]: No System Restore sequence number for this installation. === Logging stopped: 6/9/2022 12:16:37 === MSI (s) (44:60) [12:16:37:426]: User policy value 'DisableRollback' is 0 MSI (s) (44:60) [12:16:37:426]: Machine policy value 'DisableRollback' is 0 MSI (s) (44:60) [12:16:37:426]: Incrementing counter to disable shutdown. Counter after increment: 0 MSI (s) (44:60) [12:16:37:426]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2 MSI (s) (44:60) [12:16:37:436]: Note: 1: 2265 2: 3: -2147287035 MSI (s) (44:60) [12:16:37:439]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2 MSI (s) (44:60) [12:16:37:444]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1 MSI (s) (44:60) [12:16:37:463]: Destroying RemoteAPI object. MSI (s) (44:F0) [12:16:37:464]: Custom Action Manager thread ending. MSI (c) (BC:78) [12:16:37:474]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1 MSI (c) (BC:78) [12:16:37:475]: MainEngineThread is returning 3010 === Verbose logging stopped: 6/9/2022 12:16:37 === The errors below are recorded in the source=ADODB.Connection, desc=Provider cannot be found. It may not be properly installed., msg=Unknown error 0x800A0E7A 20220630213031 E #08116 EPODAL ePOData_Connection.cpp(381): COM Error 0x800A0E7A, source=ADODB.Connection, desc=Provider cannot be found. It may not be properly installed., msg=Unknown error 0x800A0E7A 20220630213031 E #08116 EPODAL ePOData_Connection.cpp(406): Error 0x800A0E7A returned from credentials callback. Database NOT available 20220630213031 E #08116 EVNTPRSR D:\BUILD_764249\BUILD\ePO\dev\src\server\include\ePOData.inl(461): Database initialization: Failed (hr=0x800A0E7A). 20220630213031 E #08116 EVNTPRSR source\servinit.cpp(164): Failed to initialize database layer. Cannot continue. 20220630213031 I #08116 EVNTPRSR EventParser Stopped. 20220630213031 I #08116 EVNTPRSR Cleaning up Server... The Event Viewer ( The installation or update for the product required a restart for all changes to take effect. The restart was deferred to a later time. 7B 34 44 34 35 34 42 41 42 2D 41 31 46 37 2D 34 39 32 44 2D 39 33 30 30 2D 35 42 46 30 35 44 42 33 30 42 45 42 7D 2C 20 33 30 31 30 Cause
The pending restart on the ePO server is interrupted to install Solution
Restart the SQL server to clear the pending reboots and manually execute the NOTE: The file path for This action helps re-establish the ePO DB connection successfully. If SQL is installed on the ePO server, you'll need to reboot the ePO server. Affected ProductsLanguages:This article is available in the following languages: |
|