5 Replies Latest reply on Aug 4, 2008 12:17 PM by dgaines

    Issues after installing LD 8.8 Mac Agent Refresh (v8.80.0.254)

    dgaines Apprentice

      I have just installed the LD 8.8 Mac Agent Refresh to my core.  I then installed to an Intel mac pro running 10.4.8 ( our base image is on that os version right now).  The client will send inventory and remote control just fine, but its patch data does not appear to be getting back to the core.   Has anyone seen this issue?  Is there any way to roll this update off?

        • 1. Re: Issues after installing LD 8.8 Mac Agent Refresh (v8.80.0.254)
          Employee

          What does /Library/Application Support/LANDesk/LANDesk.log say?

          • 2. Re: Issues after installing LD 8.8 Mac Agent Refresh (v8.80.0.254)
            dgaines Apprentice

            Jack, thanks for the reply.  Here is the log for a client that was freshly imaged.  I then installed the client and patched from 10.4.8 to 10.4.11.  It appears that going to 10.4.11is where the wheels fell off since it got the inital security scan into the database. Core is 8.8 with the latest mac client installed and all mini rollups exluding the may rollup.  Also, if you clear vulnerablity information for that client then rescan it,  the security and patch information match what is being shown in the log file.

            • 3. Re: Issues after installing LD 8.8 Mac Agent Refresh (v8.80.0.254)
              Employee

               

              okay, let's go through the file:

               

               

              02-06-2008.10:52:22: LANDesk Agent Install (start)

               

               

              It then starts the ldcron service and installs its scheduled tasks, checks for policies (there aren't any), and starts the inventory scan (this is complicated by two scans being started at once, but the mini scan makes it to the core at 10:53:01 and the full scan makes it to the core at 10:59:13 (almost 6 minutes of that is multimedia file scanning, you might try this: http://www.droppedpackets.org/macintosh/speed-up-inventory-scanning/ ).

               

               

              The first security scan starts at 10:53:05 and reports several vulns:

               

               

              Mon Jun  2 10:54:51 2008 ldpatch : Reporting vulnerability APPLE-QUICKTIME715 detected. Patch PDNo.

              Mon Jun  2 10:54:59 2008 ldpatch : Reporting vulnerability APPLE-SP-TIGER-10-1.1-COMBO-INTEL detected. Patch PDNo.

              Mon Jun  2 10:54:59 2008 ldpatch : Reporting vulnerability APPLE-SP-TIGER-11-COMBO-INTEL detected. Patch PDNo.

              Mon Jun  2 10:54:59 2008 ldpatch : Reporting vulnerability APPLE-SP-TIGER-9 detected. Patch PDNo.

              Mon Jun  2 10:54:59 2008 ldpatch : Reporting vulnerability APPLE_iTunes71 detected. Patch PDUnknown.

              Mon Jun  2 10:54:59 2008 ldpatch : Reporting vulnerability APPLE_iTunes711 detected. Patch PDUnknown.

              Mon Jun  2 10:54:59 2008 ldpatch : Reporting vulnerability APPLE_iTunes72 detected. Patch PDUnknown.

              Mon Jun  2 10:54:59 2008 ldpatch : Reporting vulnerability APPLE_iTunes73 detected. Patch PDUnknown.

              Mon Jun  2 10:54:59 2008 ldpatch : Reporting vulnerability APPLE_iTunes731 detected. Patch PDUnknown.

              Mon Jun  2 10:54:59 2008 ldpatch : Reporting vulnerability APPLE_iTunes732 detected. Patch PDUnknown.

              Mon Jun  2 10:54:59 2008 ldpatch : Reporting vulnerability APPLE_iTunes74 detected. Patch PDUnknown.

              Mon Jun  2 10:54:59 2008 ldpatch : Reporting vulnerability APPLE_iTunes741 detected. Patch PDUnknown.

              Mon Jun  2 10:54:59 2008 ldpatch : Reporting vulnerability APPLE_iTunes742 detected. Patch PDUnknown.

              Mon Jun  2 10:54:59 2008 ldpatch : Reporting vulnerability APPLE_iTunes75 detected. Patch PDUnknown.

              Mon Jun  2 10:55:08 2008 ldpatch : Reporting vulnerability Firefox20012_Update detected. Patch PDUnknown.

              Mon Jun  2 10:55:12 2008 ldpatch : Reporting vulnerability Firefox20013_Update detected. Patch PDUnknown.

              Mon Jun  2 10:55:16 2008 ldpatch : Reporting vulnerability Firefox20014_Update detected. Patch PDUnknown.

              Mon Jun  2 10:55:19 2008 ldpatch : Reporting vulnerability Firefox2_Update detected. Patch PDUnknown.

              Mon Jun  2 10:59:21 2008 ldpatch : Reporting vulnerability OPERA927_Update detected. Patch PDUnknown.

              Mon Jun  2 10:59:24 2008 ldpatch : Reporting vulnerability OPERA_MAC detected. Patch PDUnknown.

              Mon Jun  2 11:01:11 2008 ldpatch : Reporting vulnerability OFFICE-2004-1139 detected. Patch PDUnknown.

               

               

              some of which it then fixes:

               

               

              Mon Jun  2 11:01:58 2008 ldpatch : Repairing auto-fix vulnerabilities.

               

               

              iTunes7.4.1.dmg, iTunes7.5.dmg -- you should probably pick the latest and turn off autofix on the older ones.

               

               

              MacOSXUpdCombo10.4.11Intel.dmg

               

               

              Hello, another scheduled inventory scan? Also, there's an error:

               

               

              Mon Jun  2 11:03:00 2008 ldcron : Executing scheduled event (id:791): /Library/Application\ Support/LANDesk/bin/ldscan

               

               

              Mon Jun  2 11:03:01 2008 ldscan : ldconfig.xml is bad

               

               

              Anyway, by 11:10 it's ready to check the autofix work:

               

               

              Mon Jun  2 11:10:25 2008 ldpatch : Reporting vulnerability APPLE-QUICKTIME715 detected. Patch PDNo.

              Mon Jun  2 11:10:34 2008 ldpatch : Reporting vulnerability APPLE-SP-TIGER-10-1.1-COMBO-INTEL detected. Patch PDNo.

              Mon Jun  2 11:10:34 2008 ldpatch : Reporting vulnerability APPLE-SP-TIGER-11-COMBO-INTEL detected. Patch PDYes.

              Mon Jun  2 11:10:34 2008 ldpatch : Reporting vulnerability APPLE-SP-TIGER-9 detected. Patch PDNo.

              Mon Jun  2 11:10:43 2008 ldpatch : Reporting vulnerability Firefox20012_Update detected. Patch PDUnknown.

              Mon Jun  2 11:10:47 2008 ldpatch : Reporting vulnerability Firefox20013_Update detected. Patch PDUnknown.

              Mon Jun  2 11:10:52 2008 ldpatch : Reporting vulnerability Firefox20014_Update detected. Patch PDUnknown.

              Mon Jun  2 11:10:56 2008 ldpatch : Reporting vulnerability Firefox2_Update detected. Patch PDUnknown.

              Mon Jun  2 11:14:23 2008 ldpatch : Reporting vulnerability OPERA927_Update detected. Patch PDUnknown.

              Mon Jun  2 11:14:26 2008 ldpatch : Reporting vulnerability OPERA_MAC detected. Patch PDUnknown.

              Mon Jun  2 11:16:14 2008 ldpatch : Reporting vulnerability OFFICE-2004-1139 detected. Patch PDUnknown.

               

               

              This time the iTunes patches aren't reported and the OS patch is reported with an "I've been patched" flag.

               

               

              At 11:21 we do it again:

               

               

              Mon Jun  2 11:21:32 2008 ldpatch : Reporting vulnerability APPLE-JavaRelease6-TI detected. Patch PDNo.

              Mon Jun  2 11:21:57 2008 ldpatch : Reporting vulnerability APPLE-QUICKTIME715 detected. Patch PDNo.

              Mon Jun  2 11:22:00 2008 ldpatch : Reporting vulnerability APPLE-QUICKTIME716 detected. Patch PDUnknown.

              Mon Jun  2 11:22:04 2008 ldpatch : Reporting vulnerability APPLE-QUICKTIME720 detected. Patch PDNo.

              Mon Jun  2 11:22:07 2008 ldpatch : Reporting vulnerability APPLE-QUICKTIME730Ti detected. Patch PDNo.

              Mon Jun  2 11:22:10 2008 ldpatch : Reporting vulnerability APPLE-QUICKTIME731Ti detected. Patch PDNo.

              Mon Jun  2 11:22:10 2008 ldpatch : Reporting vulnerability APPLE-QUICKTIME741Ti detected. Patch PDNo.

              Mon Jun  2 11:22:10 2008 ldpatch : Reporting vulnerability APPLE-QUICKTIME745Ti detected. Patch PDNo.

              Mon Jun  2 11:22:14 2008 ldpatch : Reporting vulnerability APPLE-QUICKTIME74Ti detected. Patch PDNo.

              Mon Jun  2 11:22:21 2008 ldpatch : Reporting vulnerability APPLE-SA-2007-009-TI-UNIVERSAL detected. Patch PDNo.

              Mon Jun  2 11:22:21 2008 ldpatch : Reporting vulnerability APPLE-SA-2008-001-TI-UNIVERSAL detected. Patch PDNo.

              Mon Jun  2 11:22:21 2008 ldpatch : Reporting vulnerability APPLE-SA-2008-002(v1.0)-TI-UNIVERSAL detected. Patch PDNo.

              Mon Jun  2 11:22:21 2008 ldpatch : Reporting vulnerability APPLE-SA-2008-003-Ti11-Intel detected. Patch PDNo.

              Mon Jun  2 11:22:21 2008 ldpatch : Reporting vulnerability APPLE_iTunes76 detected. Patch PDUnknown.

              Mon Jun  2 11:22:21 2008 ldpatch : Reporting vulnerability APPLE_iTunes762 detected. Patch PDNo.

              Mon Jun  2 11:22:28 2008 ldpatch : Reporting vulnerability Firefox20012_Update detected. Patch PDUnknown.

              Mon Jun  2 11:22:32 2008 ldpatch : Reporting vulnerability Firefox20013_Update detected. Patch PDUnknown.

              Mon Jun  2 11:22:35 2008 ldpatch : Reporting vulnerability Firefox20014_Update detected. Patch PDUnknown.

              Mon Jun  2 11:22:38 2008 ldpatch : Reporting vulnerability Firefox2_Update detected. Patch PDUnknown.

              Mon Jun  2 11:24:25 2008 ldpatch : Reporting vulnerability OPERA927_Update detected. Patch PDUnknown.

              Mon Jun  2 11:24:29 2008 ldpatch : Reporting vulnerability OPERA_MAC detected. Patch PDUnknown.

              Mon Jun  2 11:26:14 2008 ldpatch : Reporting vulnerability OFFICE-2004-1139 detected. Patch PDUnknown.

               

               

              and autofix. This time dependencies are met and different iTunes and Quicktime patches are available.

               

               

              Mon Jun  2 11:27:01 2008 ldpatch : Repairing auto-fix vulnerabilities.

               

               

              MacOSXUpdCombo10.4.11Intel.dmg, QuickTime731_Tiger.dmg, JavaForMacOSX10.4Release6.dmg, QuickTime740_Tiger.dmg, iTunes.dmg, QuickTime741_Tiger.dmg, QuickTime745Tiger.dmg, itunes.-3BCcA.dmg.

               

               

              Then we report status:

               

               

              Mon Jun  2 11:36:19 2008 ldpatch : Reporting vulnerability APPLE-SA-2007-009-TI-UNIVERSAL detected. Patch PDNo.

              Mon Jun  2 11:36:19 2008 ldpatch : Reporting vulnerability APPLE-SA-2008-001-TI-UNIVERSAL detected. Patch PDNo.

              Mon Jun  2 11:36:19 2008 ldpatch : Reporting vulnerability APPLE-SA-2008-002(v1.0)-TI-UNIVERSAL detected. Patch PDNo.

              Mon Jun  2 11:36:19 2008 ldpatch : Reporting vulnerability APPLE-SA-2008-003-Ti11-Intel detected. Patch PDNo.

              Mon Jun  2 11:36:28 2008 ldpatch : Reporting vulnerability Firefox20012_Update detected. Patch PDUnknown.

              Mon Jun  2 11:36:31 2008 ldpatch : Reporting vulnerability Firefox20013_Update detected. Patch PDUnknown.

              Mon Jun  2 11:36:35 2008 ldpatch : Reporting vulnerability Firefox20014_Update detected. Patch PDUnknown.

              Mon Jun  2 11:36:38 2008 ldpatch : Reporting vulnerability Firefox2_Update detected. Patch PDUnknown.

              Mon Jun  2 11:38:32 2008 ldpatch : Reporting vulnerability OPERA927_Update detected. Patch PDUnknown.

              Mon Jun  2 11:38:35 2008 ldpatch : Reporting vulnerability OPERA_MAC detected. Patch PDUnknown.

              Mon Jun  2 11:40:21 2008 ldpatch : Reporting vulnerability OFFICE-2004-1139 detected. Patch PDUnknown.

               

               

              Mon Jun  2 11:41:08 2008 ldpatch : Scanning SVE vulnerabilities.

               

               

              but something goes wrong here. Was it waiting for input, perhaps? There's a 12:49:52 record of LANDesk Agent terminating, did it maybe want a reboot after the OS patches? Anyway, wcdusting remote controlled it and it finished the patch scan.

               

               

              Mon Jun  2 12:49:12 2008 ldremote :     Port 9535: Created data socket(7).

               

               

              Mon Jun  2 12:50:23 2008 ldpatch : Exit value:229835155

              Mon Jun  2 12:50:23 2008 ldpatch : Patch exited.

               

               

              12:55, another security scan:

               

               

              Mon Jun  2 12:55:48 2008 ldpatch : Reporting vulnerability APPLE-SA-2007-009-TI-UNIVERSAL detected. Patch PDNo.

              Mon Jun  2 12:55:48 2008 ldpatch : Reporting vulnerability APPLE-SA-2008-001-TI-UNIVERSAL detected. Patch PDNo.

              Mon Jun  2 12:55:48 2008 ldpatch : Reporting vulnerability APPLE-SA-2008-002(v1.0)-TI-UNIVERSAL detected. Patch PDNo.

              Mon Jun  2 12:55:48 2008 ldpatch : Reporting vulnerability APPLE-SA-2008-003-Ti11-Intel detected. Patch PDNo.

              Mon Jun  2 12:55:55 2008 ldpatch : Reporting vulnerability Firefox20012_Update detected. Patch PDUnknown.

              Mon Jun  2 12:55:59 2008 ldpatch : Reporting vulnerability Firefox20013_Update detected. Patch PDUnknown.

              Mon Jun  2 12:56:02 2008 ldpatch : Reporting vulnerability Firefox20014_Update detected. Patch PDUnknown.

              Mon Jun  2 12:56:05 2008 ldpatch : Reporting vulnerability Firefox2_Update detected. Patch PDUnknown.

              Mon Jun  2 12:57:53 2008 ldpatch : Reporting vulnerability OPERA927_Update detected. Patch PDUnknown.

              Mon Jun  2 12:57:57 2008 ldpatch : Reporting vulnerability OPERA_MAC detected. Patch PDUnknown.

              Mon Jun  2 12:59:42 2008 ldpatch : Reporting vulnerability OFFICE-2004-1139 detected. Patch PDUnknown.

              Mon Jun  2 13:00:27 2008 ldpatch : Repairing auto-fix vulnerabilities.

              Mon Jun  2 13:00:27 2008 ldpatch : Exit value:229835155

              Mon Jun  2 13:00:27 2008 ldpatch : Patch exited.

               

               

              Again at 1:10:

               

               

              Mon Jun  2 13:10:50 2008 ldpatch : Patch started.

              Mon Jun  2 13:11:41 2008 ldpatch : Reporting vulnerability APPLE-SA-2007-009-TI-UNIVERSAL detected. Patch PDNo.

              Mon Jun  2 13:11:41 2008 ldpatch : Reporting vulnerability APPLE-SA-2008-001-TI-UNIVERSAL detected. Patch PDNo.

              Mon Jun  2 13:11:41 2008 ldpatch : Reporting vulnerability APPLE-SA-2008-002(v1.0)-TI-UNIVERSAL detected. Patch PDNo.

              Mon Jun  2 13:11:41 2008 ldpatch : Reporting vulnerability APPLE-SA-2008-003-Ti11-Intel detected. Patch PDNo.

              Mon Jun  2 13:11:48 2008 ldpatch : Reporting vulnerability Firefox20012_Update detected. Patch PDUnknown.

              Mon Jun  2 13:11:52 2008 ldpatch : Reporting vulnerability Firefox20013_Update detected. Patch PDUnknown.

              Mon Jun  2 13:11:55 2008 ldpatch : Reporting vulnerability Firefox20014_Update detected. Patch PDUnknown.

              Mon Jun  2 13:11:59 2008 ldpatch : Reporting vulnerability Firefox2_Update detected. Patch PDUnknown.

              Mon Jun  2 13:13:46 2008 ldpatch : Reporting vulnerability OPERA927_Update detected. Patch PDUnknown.

              Mon Jun  2 13:13:50 2008 ldpatch : Reporting vulnerability OPERA_MAC detected. Patch PDUnknown.

              Mon Jun  2 13:15:35 2008 ldpatch : Reporting vulnerability OFFICE-2004-1139 detected. Patch PDUnknown.

              Mon Jun  2 13:16:27 2008 ldpatch : Repairing auto-fix vulnerabilities.

              Mon Jun  2 13:16:27 2008 ldpatch : Exit value:229835155

              Mon Jun  2 13:16:27 2008 ldpatch : Patch exited.

               

               

              That's it aside from some remote control and inventory scan activity.  It looks like the agent's doing the right thing. I assume that the console screenshot is after all this activity and it isn't updating to reflect that the right thing was done? What does the Mac's system info think about patch level?

               

               

              • 4. Re: Issues after installing LD 8.8 Mac Agent Refresh (v8.80.0.254)
                dgaines Apprentice

                Right now they both are in sync.  Both the Landesk information and system update agree that the secupd2008-003 needs to be applied.

                • 5. Re: Issues after installing LD 8.8 Mac Agent Refresh (v8.80.0.254)
                  dgaines Apprentice

                  After applying SP1 and the new macintosh client to the systems, this problem has cleared up.