4 Replies Latest reply on Nov 12, 2015 10:13 AM by cwinning

    Slow Patch Deployment

    Rookie

      I have a machine that was deployed 60 patches yesterday around 4pm.  18 hours later it is still patching at 52/60.  We have several servers that exhibit this behavior with Shavlik and I'm trying to figure out why. These are agentless, console-push deployments.  90% of servers work great.

       

      The dplyevts log shows:

      2015-11-12T15:30:08.0595602Z 0730 I PingBack.cpp:53 Sending data to 'https://LHI-SECPRD03:3121/ST/Console/Deployment/Tracker/V92'.

      2015-11-12T15:30:08.0595602Z 0730 E HttpDownload.cpp:1249 WinHttpOpen failed: 87.

      2015-11-12T15:30:08.0595602Z 0730 E HttpDownload.cpp:491 AttemptIEProxySession failed.

       

      Other logs in the folder do not have any errors, warnings, or failures I can see.  Logs in the ProPatches (cl5, etc) folder are not updating, maybe not used with 9.2?''

       

      Processes Trusted Installer is at 25% with 1.8 GB of memory committed and churning.  Svchost has almost a GB.  Memory usage only 60% total on the machine.

       

      I have an SRV 2017 event in the System log:  System unable to allocate nonpaged pool - at configured limit.  4 events total since patching started.  Never seen before today.

       

      TONS of MsiInstaller events in the Application log, but just a few yellows.

       

       

      We've had issues in the past with certs/keys for the scheduler, but I am not seeing that.  I will scrub every last vestige of Shavlik from the machine and rescan - that usually sorts things out, but I am at a loss currently as to what is causing the slowness here and where to look next for a clue.

        • 1. Re: Slow Patch Deployment
          cwinning CommunityTeam

          Hello,

           

          The Tracker errors you have there would not cause this issue.  Whatever the issue is, it's going to be 'something' on the servers with slow deployments.  Often, Windows Update is causing deployments these types of issues.  You need to make sure the Windows Updates settings are set to never check for updates. (verify in GPO)

          We have seen where previous WSUS configurations caused similar issue. Specifically, the setting "Specify intranet Microsoft updater service location" was pointing to old address. Removing this setting allowed all deployments to run as they should.

           

          Thanks,

          Charles

          • 2. Re: Slow Patch Deployment
            Rookie

            It does indeed seem to be WSUS that is the culprit.  I found some info in another thread about cab files being created at Windows\Temp and Windows\Logs\CBS.  Trying the solution now.

             

            We use Shavlik and WSUS simultaneously in our environment.  Is there a recommended way to do this?  Or should it just not be done?

             

             

            EDIT:  Here's the solution post.  Re: After Patching a Group of Servers, C:\Windows\Temp is now filling up with Cab_ files

             

            It works great.  Just installed 17 patches in 7 minutes on the affected machine after applying the solution.

            • 3. Re: Slow Patch Deployment
              cwinning CommunityTeam

              Hello,

               

              OK, let us know how the solution works out.

               

              "We use Shavlik and WSUS simultaneously in our environment.  Is there a recommended way to do this?  Or should it just not be done?"

               

              I've spoken with other customers using WSUS and Protect at the same time and it works without issue most of the time.  You just need to be mindful of the occasional issue like this.

               

              Thanks,

              Charles

              • 4. Re: Slow Patch Deployment
                cwinning CommunityTeam

                Nice, just read your edit, thanks for letting us know!

                 

                Charles