What does /Library/Application Support/LANDesk/LANDesk.log say?
Jack, thanks for the reply. Here is the log for a client that was freshly imaged. I then installed the client and patched from 10.4.8 to 10.4.11. It appears that going to 10.4.11is where the wheels fell off since it got the inital security scan into the database. Core is 8.8 with the latest mac client installed and all mini rollups exluding the may rollup. Also, if you clear vulnerablity information for that client then rescan it, the security and patch information match what is being shown in the log file.
okay, let's go through the file:
02-06-2008.10:52:22: LANDesk Agent Install (start)
It then starts the ldcron service and installs its scheduled tasks, checks for policies (there aren't any), and starts the inventory scan (this is complicated by two scans being started at once, but the mini scan makes it to the core at 10:53:01 and the full scan makes it to the core at 10:59:13 (almost 6 minutes of that is multimedia file scanning, you might try this: http://www.droppedpackets.org/macintosh/speed-up-inventory-scanning/ ).
The first security scan starts at 10:53:05 and reports several vulns:
some of which it then fixes:
iTunes7.4.1.dmg, iTunes7.5.dmg -- you should probably pick the latest and turn off autofix on the older ones.
Hello, another scheduled inventory scan? Also, there's an error:
Anyway, by 11:10 it's ready to check the autofix work:
This time the iTunes patches aren't reported and the OS patch is reported with an "I've been patched" flag.
At 11:21 we do it again:
and autofix. This time dependencies are met and different iTunes and Quicktime patches are available.
MacOSXUpdCombo10.4.11Intel.dmg, QuickTime731_Tiger.dmg, JavaForMacOSX10.4Release6.dmg, QuickTime740_Tiger.dmg, iTunes.dmg, QuickTime741_Tiger.dmg, QuickTime745Tiger.dmg, itunes.-3BCcA.dmg.
Then we report status:
but something goes wrong here. Was it waiting for input, perhaps? There's a 12:49:52 record of LANDesk Agent terminating, did it maybe want a reboot after the OS patches? Anyway, wcdusting remote controlled it and it finished the patch scan.
12:55, another security scan:
Again at 1:10:
That's it aside from some remote control and inventory scan activity. It looks like the agent's doing the right thing. I assume that the console screenshot is after all this activity and it isn't updating to reflect that the right thing was done? What does the Mac's system info think about patch level?
Right now they both are in sync. Both the Landesk information and system update agree that the secupd2008-003 needs to be applied.
After applying SP1 and the new macintosh client to the systems, this problem has cleared up.