9.2 Patch 5 for IBM BigFix Platform (Updated)

[steve]

The IBM BigFix team is releasing 9.2 Patch 5 (9.2.5.130) of the IBM BigFix Platform. The main features of this release are APAR fixes, security vulnerability fixes, agent support for Windows 10, and general bug fixes. Relay support for CentOS 5/6/7 and agent support for CentOS 7 is also being announced for all 9.2 versions (9.2.0 and above).

Get more information by reading the full technical changelist at: https://support.bigfix.com/bes/changes/fullchangelist-92.txt

Components Affected:
All IBM BigFix Platform components are affected.

Upgrade:
Downloads and release information are available at:
http://support.bigfix.com/bes/release/9.2/patch5/
Upgrade fixlets are available in BES Support version 1221 (or higher).

Important Notes:

• The 9.2.5 upgrade will likely take longer than previous IEM/BigFix upgrades
• The duration is proportional to the amount of subscribed external content, number of client uploads on the server and speed of server hardware; and could take multiple hours for some deployments
• Deployments actively using SUA or ILMT are expected to have higher numbers of client uploads and will be more impacted
• The UI does not display the progress of the upgrade and will be unresponsive while the upgrade is occurring

It is important to let the upgrade complete once started. To confirm the upgrade is still progressing, reference the following technote (http://www-01.ibm.com/support/docview.wss?uid=swg21962862) or contact IBM support.

As usual, IBM recommends testing the server upgrade in an isolated lab environment prior to completing a production upgrade. For a description of this process and upgrade best practices, see https://www.ibm.com/developerworks/community/wikis/home?lang=en#!/wiki/Tivoli%20Endpoint%20Manager/page/Upgrading%20Best%20Practices

[steve]

[AlanM]

For those of you that install QnA everywhere, this catches the Windows client up to all other platforms by installing it with every client, and this version is a Console application so it will run on Core server platforms as well. The command line interface is the same as every other platform as well now.

Fixlet Debugger didn’t change and is still a Windowed application.

[AlanM]

In addition if you are looking at Windows 10, you will need the agent from this release or later to support that platform.

[dhtorsdc]

NB: Take heed of the retroactively added (updated) “Important Notes” section re the extra length of time required and no feedback - even on a small instance. Ugh. Please fix the feedback part going forward. Here’s some strong text:

strong text
strong text
strong text

[mbartosh]

Just before the end of the upgrade a Window popped up asking for the proxy password. I entered a password. It appeared to be wrong and then the Window closed. I do not need to set proxy settings and I do no have proxy settings set. Does anyone know why the proxy Window appeared? According to support it should not have.

[Sidd]

IEM console 9.2 patch 5 is not backward compatible. I am not able to connect to old versions of IEM servers.

[AlanM]

This is normal behaviour. The consoles and servers need to remain able to talk the same language and when a schema or interface changes they need to be the same.

For the releases we currently have, the server and console should always be the same version

[jpolovic]

Have requirements for the IEM Console changed somehow in patch 3?
All the previous version worked before but its not possible to install latest version on Win 7 Enterprise 32-bit anymore.

[gearoid]

Console is a 64-bit application. Have you previously installed the 9.2.* Console on 32bit ?
The requirements report for console only shows supported on 64-bit.
See https://support.bigfix.com/bes/changes/fullchangelist-92.txt and the sections :

= Changes between 9.2.2.21 and 9.2.3.68 =

Features Added or Changed

• Windows Server Components (Server, Console, Web Reports, FillDB, and BESAdmin) are now 64-bit Windows applications.

…

=====================================
= Changes between 9.1 and 9.2.0.363 =

…

• OS Support

  • Linux Server, Relay and Agent components can now be installed on RHEL 7
  • MS Windows 2003 R2 is no longer supported for the IEM Server, Web Reports and Console
  • Windows Server and WebReports components can now be installed on 64-bit platforms only (MS Windows Server 2008 and higher)
    The IEM Server installer prevents deployment on 32-bit operating systems.
    The IEM Console installer will allow a manual installation on 32-bit platforms. Future Console installer releases will not support this mode of installation.

[jpolovic]

Yes, we used the version 9.2.2.21 of a Console without a problem. Now I see in the release notes that since 9.2.3 it is a 64-bit application. It was just confusing as in IEM Console requirements, it is listed as 64-Tolerate app for x86-64 hardware.

Does it mean there are no plans to support it on 32-bit systems in the future? Unfortunately, all the workstations used in our company are 32-bits, even in year 2015. In that case we might need to downgrade IEM or find some “workaround”.

[AlanM]

Correct there are no plans to continue supporting the server components on 32 bit OS’s

The amount of data in use requires the 64 bit address space for many customers.

[tsikma]

I upgraded the server/relay/clients this week and noticed that the start type of service “X” is no longer working. I am guessing it is something with the new client but I opened up a ticket for support as we were using this for a few different tasks. the result was usually manual/demand/disabled based on the start type of the service

example:
q: exists service "SepMasterService"
A: True
T: 0.019 ms

q: start type of service “SepMasterService” | "Not Installed"
A: Not Installed
T: 0.025 ms

[steve]

Yeah, it looks like this is a bug in the 9.2.5 agent. You’ll likely have to downgrade these agents until we can release a fix, or use a workaround like:

value "Start" of key "HKLM\SYSTEM\CurrentControlSet\Services\BESClient" of native registry

[tsikma]

Understood, PMR was already submitted for it too.

Can you easily downgrade the clients by taking the 9.2.1 job and removing the relevance for version of client < “9.2.1.48” and version of client >= “7.2”? Just wondering the effort for 20000+ endpoints versus just recreating the properties using the relevance you provided (which results in 2/3/4 which correlates to Automatic/Manual/Disabled in Services).

[steve]

No, the installer only works if the existing client is at an older version, so you’d have to do a custom action to remove and then reinstall. Or do an uninstall action, and then use the client deploy tool or AD login script to re-install the older version.

[jgstew]

I would definitely recommend the option of uninstalling and then reinstalling with a BAT file deployed through BigFix if you need to downgrade.

I wouldn’t recommend just uninstalling and then trying to get another mechanism to work to get it back… I would only recommend that if there are failures.

[jgstew]

See this related post:

9.2.5 client issue with "start type of services" inspector

Reply from IBM Support is that there's already an APAR on this - IV76004. That APAR notes the problem in QnA, but does not mention that this is actually a problem in the client that will cause Fixlets to evaluate incorrectly. Does anyone have an estimate on when this would be corrected? Or considered putting a warning on the 9.2.5 upgrade fixlet, maybe removing its Default Action due to known issues?

[tsikma]

Here is some more information that I got from support a couple days ago

I was informed that the fix for the reported issue is going to be on Patch 9.2.6, and it will cover the client and QNA.

I just got the information that the ETA for patch 9.2.6 will be on November 2015.

[jgstew]

That is quite a ways off.