eDP Case backups are failing with error - McLogEvent Event ID: 5000

Problem

Case backups in an eDP clustered environment may be disrupted by McShield due to strict "heartbeat" checking. eDP Node Clusters use "heartbeat" to verify the node is online.

Error Message

The following errors are found in the eDP Server log:

• Network name no longer available
• Node will be disabled

The following error is found in the Windows Application Event log:

• Log Name:      Application
Source:        McLogEvent
Event ID:      5000
Task Category: None
Level:         Information
Keywords:      Classic
User:          SYSTEM
Computer:      CW_Appliance.domainName.com
Description:
The description for Event ID 5000 from source McLogEvent cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

Solution

McAfee forums reference McLogEvent Event ID 5000:

McAfee SME comment from McAfee forum at link above:

 "Event 5000 is generated when the scanner comes online. This means it's reading many megabytes of data into memory (~140mb), then flushing a large portion of that data back to disk (creating a ~90mb memory mapped file).

 This is a resource intensive operation. Apps that are sensitive to "heartbeat" probes are quite likely to think their heartbeat has stopped.

 If your VPN or other network access control solution uses a heartbeat, this is likely the issue. The resolution would be to lighten up the heartbeat check - though there are some thread priority tweaks you can look into in our knowledge base." [End quote]

Link -  https://community.mcafee.com/thread/44597