Product guide

Problem Solution
The McAfee EIA Service does
not start
In case the McAfee EIA Service does not start:
• Check if Firecore service is running (start if it is not running)
• In case VSE is present, disable Access Protection to start the
Firecore service.
• Check if the McAfee EIA service is running (start if it is not
running).
Verify the status of Firecore installation. If there is a problem, try
reinstalling Firecore from the installation directory:
• Uninstall Firecore: mfehidin.exe -u -x nia.xml -l firecore.log
• Install Firecore: mfehidin.exe -i -x nia.xml -l firecore.log
Reputation not received on
firewall for an application even
after multiple connections.
Dump the reputation cache:
• In memory reputation cache can be dumped by creating the
following registry key:
• HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\McAfee
\Endpoint Intelligence Agent\Configured\DumpCache
• It must be REG_MULTI_SZ.
• Set its value to 1.
• Reputation will be written to cachedReputation.txt in the
installation directory, for example, C:\Program Files
(x86)\McAfee\Endpoint Intelligence Agent\x64.
Troubleshooting ePO
deployments
To enable manual configuration for troubleshooting ePO
deployments:
• Go to key: HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\Network
Integrity Agent\Settings
• Change ShowGuiButton to 1.
• Reopen the McAfee EIA configuration dialog box.
If DTLS connection is not
established between EIA and
the network device
Check if the certificate verification is successful and the shared key
is correct in the status screen.
Issues related to routing Verify the routing information. The current routing table is printed
in the logs every time a new route is added.
Issues related to MA View the MA status, go to McAfee\Common framework, and run
cmdagent.exe /s.
Issues with the installer Collect the following log files for information:
• ePO, eia install log
• etlTrace, mfe-eiaepocom and mfe-eia logs
• mfe-eiaconfig.log
Issues with the McAfee EIA
service
In case of issues with the McAfee EIA service:
• Enable debug logs for McAfee EIA service by changing the log
level to debug in the ePO advanced policy.
• Collect all mfe-eia.log and mfe-eiaepocom logs.
• Dump the reputation cache by following the preceding point.
• If possible, use Wireshark to analyze captures on the host.
5
Maintenance and troubleshooting
Troubleshooting tips
32
Endpoint Intelligence Agent 2.1.0 Product Guide