5 Replies Latest reply on May 24, 2016 10:44 AM by cwinning

    Two clients can't send Patch Scan Data back to our server

    Rookie

      Hi,
      Fairly new to Shavlik - the guy who previously was in charge of it has quit. We have about 330 clients that we are updating through Shavlik, but 2 of them can't seem to send back the "Latest Patch Scan Date" back to our Shavlik-server. So when I log in to the client servers and check the agent and manually try to start a Scan it says "Scan Complete" but the date never changes in our Shavlik server. So I look at the STDispatch.log here: C:\ProgramData\LANDESK\Shavlik Protect\Logs and I find these rows:

       

      2016-05-19T12:13:47.3674980Z 5370 I Authenticode.cpp:134 Verifying signature of C:\Program Files (x86)\LANDESK\Shavlik Protect Agent\STPatch.exe with CWinTrustVerifier
      2016-05-19T12:13:47.3845033Z 5370 I CommandLineTask.cpp:320 Beginning task [b33485f0-2a86-43a2-b5a5-e545618e44d9] command line: "C:\Program Files (x86)\LANDESK\Shavlik Protect Agent\STPatch.exe" -rpc_endpoint 9e18ae44-5656-46bb-9299-630aa439844c
      2016-05-19T12:13:47.4595057Z 5370 I RpcExecutionContext.cpp:46 Engine available.
      2016-05-19T12:13:47.4595057Z 5370 I RpcExecutionContext.cpp:53 Engine started.
      2016-05-19T12:13:47.4595057Z 5370 I Dispatcher.cpp:336 Starting task: 9ede91e3-1d0c-4c90-a444-5a3b01fb4e17
      2016-05-19T12:13:57.0359482Z 5370 I Dispatcher.cpp:468 [9ede91e3-1d0c-4c90-a444-5a3b01fb4e17] Engine returned document for job.
      2016-05-19T12:13:57.0689308Z 5370 I ResultSpool.cpp:83 Could not send cached result: dispatchResultCache0, error: class STCore::Remoting::CRpcException at ResultTransferClient.cpp:29: The RPC server is unavailable.
      2016-05-19T12:13:57.0699310Z 5370 E ResultSpool.cpp:56 Sending result to queue failed with error: class STCore::Remoting::CRpcException at ResultTransferClient.cpp:29: The RPC server is unavailable.
      . Caching for future retry.
      2016-05-19T12:13:57.1929394Z 5370 I Dispatcher.cpp:208 Completing task: 9ede91e3-1d0c-4c90-a444-5a3b01fb4e17
      

       

      Any help is appreciated. The RPC services are started both on our client and on our Shavlik server. I can ping the client from the Shavlik server, I can ping the Shavlik server from the client. Any help at all is appreciated!

        • 1. Re: Two clients can't send Patch Scan Data back to our server
          cwinning CommunityTeam

          Hello,

           

          Make sure port 3121 is open from the agent client to the Protect server.  Does a check-in work when you run it from the agent UI on the client?

           

          Thanks,

          Charles

          • 2. Re: Two clients can't send Patch Scan Data back to our server
            Rookie

            Yes, the check-in is working. Atleast the UI is telling me that . The thing is that both clients worked a couple of months ago, and it's just recently that we found out they haven't been patched as intended.

            This is the log from when I performed the Agent Check-In. Row 5 below is where it's contacting our local Shavlik server, however row 7 & 8 makes me feel like it couldn't actually contact the Shavlik server, however the GUI says "Complete".

             

            2016-05-20T06:01:36.1687372Z 25c8 I STAgentUpdater.cpp:582 'C:\Program Files (x86)\LANDESK\Shavlik Protect Agent\STAgentUpdater.exe' is starting, version: 9.2.2467.0.
            2016-05-20T06:01:36.1687372Z 25c8 I STAgentUpdater.cpp:615 Running "C:\Program Files (x86)\LANDESK\Shavlik Protect Agent\STAgentUpdater.exe" -checkin
            2016-05-20T06:01:36.8250389Z 25c8 I Authenticode.cpp:134 Verifying signature of C:\Program Files (x86)\LANDESK\Shavlik Protect Agent\AgentUpdatePatch.dll with CWinTrustVerifier
            2016-05-20T06:01:36.8719182Z 25c8 I EnginePluginClientBase.cpp:181 Loaded C:\Program Files (x86)\LANDESK\Shavlik Protect Agent\AgentUpdatePatch.dll 9.2.2467.0
            2016-05-20T06:01:37.6375995Z 25c8 I CheckIn.cpp:344 Checking in using: 'https://192.168.254.20:3121/ST/Console/AgentState/V81'
            2016-05-20T06:01:38.9201269Z 25c8 I PolicyUpdate.cpp:97 StateChange: NewPolicy
            2016-05-20T06:01:40.2170555Z 25c8 E HttpDownload.cpp:1249 WinHttpOpen failed: 87.
            2016-05-20T06:01:40.2170555Z 25c8 E HttpDownload.cpp:491 AttemptIEProxySession failed.
            2016-05-20T06:01:41.0139913Z 25c8 I Authenticode.cpp:116 Verifying signature of C:\ProgramData\LANDESK\Shavlik Protect\Agent\protect.manifest.cab with CWinTrustVerifier
            2016-05-20T06:01:41.3577719Z 25c8 I BinaryUpdate.cpp:164 Version 9.2.5046.0 of AGENT is installed.
            2016-05-20T06:01:41.5140341Z 25c8 I BinaryUpdate.cpp:164 Version 9.2.5046.0 of AGENTPATCH is installed.
            2016-05-20T06:01:41.5140341Z 25c8 I WtsManager.cpp:392 Initialized, WTS present: true.
            2016-05-20T06:01:41.5140341Z 25c8 I BinaryUpdate.cpp:164 Version 9.2.5046.0 of AGENTPATCH is installed.
            2016-05-20T06:01:41.5140341Z 25c8 I STAgentUpdater.cpp:483 Sending update notification '3'.
            2016-05-20T06:01:41.5140341Z 25c8 I CheckIn.cpp:524 Publishing framework update, also notifying the STAgent service.
            2016-05-20T06:01:41.5140341Z 25c8 I CheckIn.cpp:534 Framework update notification to the STAgent service failed. Attempting service restart.
            2016-05-20T06:01:41.8268748Z 25c8 I Authenticode.cpp:134 Verifying signature of C:\Program Files (x86)\LANDESK\Shavlik Protect Agent\AgentUpdatePatch.dll with CWinTrustVerifier
            2016-05-20T06:01:41.8388740Z 25c8 I EnginePluginClientBase.cpp:181 Loaded C:\Program Files (x86)\LANDESK\Shavlik Protect Agent\AgentUpdatePatch.dll 9.2.2467.0
            2016-05-20T06:01:41.8388740Z 25c8 I Authenticode.cpp:100 Verifying signature of C:\Program Files (x86)\LANDESK\Shavlik Protect Agent\AgentUpdateUI.dll with CWinTrustVerifier
            2016-05-20T06:01:42.2429045Z 25c8 I Authenticode.cpp:134 Verifying signature of C:\Program Files (x86)\LANDESK\Shavlik Protect Agent\AgentUpdatePatch.dll with CWinTrustVerifier
            2016-05-20T06:01:42.2549047Z 25c8 I EnginePluginClientBase.cpp:181 Loaded C:\Program Files (x86)\LANDESK\Shavlik Protect Agent\AgentUpdatePatch.dll 9.2.2467.0
            2016-05-20T06:01:42.2549047Z 25c8 I EngineDataUpdate.cpp:42 Calling catalog data update for AGENTPATCH
            2016-05-20T06:01:42.3271030Z 25c8 I License.cpp:56 Initialized licensing with 288 capabilities. Product is licensed. Expires on 2016-11-30T00:00:00.
            2016-05-20T06:01:42.6240525Z 25c8 I AgentUpdatePatch.cpp:45 Patch file download started
            2016-05-20T06:01:46.6374864Z 25c8 I FileSynchronizer.cpp:278 For coreFileKey 'WINDOWSPATCHDATA', the following patch-delta models are available:
            2016-05-20T06:01:47.3749704Z 25c8 I FileSynchronizer.cpp:291 From all available patch-delta models, the following subset was selected for upgrading coreFileKey 'WINDOWSPATCHDATA':
            2016-05-20T06:01:47.3749704Z 25c8 I FileSynchronizer.cpp:294 FromVersion='2.0.1.8974', ToVersion='2.0.1.9026'
            2016-05-20T06:01:47.5438009Z 25c8 E HttpDownload.cpp:1249 WinHttpOpen failed: 87.
            2016-05-20T06:01:47.5438009Z 25c8 E HttpDownload.cpp:491 AttemptIEProxySession failed.
            2016-05-20T06:01:49.2627535Z 25c8 I FileSynchronizer.cpp:162 Upgrading 'C:\ProgramData\LANDESK\Shavlik Protect\Agent\Patch\WindowsPatchData.zip' from version '2.0.1.8974' to version '2.0.1.9026'.
            2016-05-20T06:01:58.7281582Z 25c8 E HttpDownload.cpp:1249 WinHttpOpen failed: 87.
            2016-05-20T06:01:58.7281582Z 25c8 E HttpDownload.cpp:491 AttemptIEProxySession failed.
            2016-05-20T06:02:27.7642138Z 25c8 I PatchDataFiles.cpp:104 File download succeeded - WindowsPatchData.zip
            2016-05-20T06:02:27.7642138Z 25c8 I AgentUpdatePatch.cpp:53 Patch file download completed
            

             

            It should also be noted that I've tried re-installing the Shavlik client on both of these servers that can't seem to send their scan dates. I've uninstalled the program to do a clean install, so that means removing the program, registry files, all files on the server that have anything to do with Shavlik, old certificates and so forth.

            • 3. Re: Two clients can't send Patch Scan Data back to our server
              cwinning CommunityTeam

              Hello,

               

              The following is normal log chatter, they don't indicate an issue unless followed by more connection errors. 

              • 2016-05-20T06:01:47.5438009Z 25c8 E HttpDownload.cpp:1249 WinHttpOpen failed: 87. 
              • 2016-05-20T06:01:47.5438009Z 25c8 E HttpDownload.cpp:491 AttemptIEProxySession failed.

               

              The logging level set for the agents need to be elevated to All in the agent policy,  Once set, perform a check-in from the agent to ensure it receives the update.

              Attempt another scan and take a look at the logs. You should get better feedback to what is going on.

               

              Does the information in the Overview tab of the agent look up to date?

              Do these machines connect directly to the Protect server or do they go through the Cloud?

              In Protect, go to the Tools > Console Alias Editor - Make sure you have the netbios name, FQDN and IP address of the Protect server listed.

               

              Thanks,

              Charles

              • 4. Re: Two clients can't send Patch Scan Data back to our server
                Rookie

                Hi Charles,

                Thanks for looking in to the problems we are experiencing. Changed the logging to All of the policy and performed an Agent Check-In. According to the log the server obviously gets the changes:

                 

                2016-05-24T13:35:37.6058391Z 1810 I STDispatch.cpp:40 Received Policy Update Notification. Resetting everything.
                
                

                 

                Restarted the service on the client machine, restarted the STAgentUI, did a new Scan, yet the log remains as undetailed as before:

                 

                2016-05-24T13:38:03.2473975Z 2b34 I Dispatcher.cpp:336 Starting task: 79c453fc-1b5c-472f-9875-5240a08563ad
                2016-05-24T13:38:12.2989579Z 2b34 I Dispatcher.cpp:468 [79c453fc-1b5c-472f-9875-5240a08563ad] Engine returned document for job.
                2016-05-24T13:38:12.3278655Z 2b34 I ResultSpool.cpp:83 Could not send cached result: dispatchResultCache0, error: class STCore::Remoting::CRpcException at ResultTransferClient.cpp:29: The RPC server is unavailable.
                2016-05-24T13:38:12.3288636Z 2b34 E ResultSpool.cpp:56 Sending result to queue failed with error: class STCore::Remoting::CRpcException at ResultTransferClient.cpp:29: The RPC server is unavailable.
                . Caching for future retry.
                2016-05-24T13:38:12.4508699Z 5108 I Dispatcher.cpp:208 Completing task: 79c453fc-1b5c-472f-9875-5240a08563ad
                
                

                 

                All our clients connect directly to the server. When I check the Console Alias Editor all the details in there are correct, it has both FQDN, NETBIOS name, IP (local and external). These two servers in question can reach our Shavlik server both by local and external IP.

                 

                EDIT: And yes, the Overview tab seems to be correct.

                • 5. Re: Two clients can't send Patch Scan Data back to our server
                  cwinning CommunityTeam

                  Hello,

                   

                  Thanks for the response,

                   

                  We're going to need all of the logs, the snippets aren't enough at this point.  I think it would be advisable opening a case at this point and include whatever logs you have.  The support team may need a WebEx to take a look at the agents real-time.

                   

                  Support Portal

                   

                  Thanks,

                  Charles