Joseph Hinkle at MyITForum.com

I had a site full of clients that seemed to be using random servers for updates instead of the local repository. After changing the policy so that it could only fall back to our central site, the clients still fell back consistently. After some log diving, my first with McAfee, I found the following:

• Looking at the agent logs from the McAfee console is mostly useless for troubleshooting this issue, as no server is actually listed for any of the processes.
• The FrameSvc log at the top of the log page for that client is much more helpful. In the details, the error "SiteStat.xml is invalid" was found, which led me to the server (which was obvious, but the server guys didn't think it was their problem initially)
• After checking http://<siteserver>:9601/software/sitestat.xml I found that the repository was disabled. It was a simple fix, but somewhat painful to find from the client-side.