Bigfix 11 AIX Client crash

Usage and Config Platform
1

Hello,

We updated our Bigfix infrastructure and we have issues for our AIX clients.
The client starts correctly and after some time crash with core generation.
The behavior is the same for all our AIX servers (not specially at the same time).
Our Linux clients are OK.

• Details of our infrastructure :

  • 1 Bigfix server on a linux server
  • 4 AIX bigfix clients
  • 14 Linux bigfix clients

• Details on our AIX servers :

  • AIX OS : 7.2 TL5 SP4
  • Bigfix client : BESAgent-11.0.0.175

**• AIX Logs (errpt) **
CORE FILE NAME
/var/opt/BESClient/core
PROGRAM NAME
BESClient
STACK EXECUTION DISABLED
0
COME FROM ADDRESS REGISTER
??
PROCESSOR ID
hw_fru_id: N/A
hw_cpu_id: N/A

ADDITIONAL INFORMATION
pthread_k C4
??
p_raise 48
raise 4C
abort BC
myabort_ 10
_ZSt9term 64
__cxa_ret 94

• Bigfix client Logs
At 08:40:46 +0200 - BES Support (http://sync.bigfix.com/cgi-bin/bfgather/bessupport)
Fixed - AIX: Change Digital Signature Policy (fixlet:5432)
At 08:40:46 +0200 - IBM License Reporting (http://sync.bigfix.com/cgi-bin/bfgather/ibmlicensereporting)
Not Relevant - Scanner Trace Settings (fixlet:7)
Not Relevant - Software Scan Status (fixlet:55)
Fixed - Initiate Software Scan (9.2.32.0) (fixlet:2)
Fixed - Configure Scanner Query Timeout (9.2.32.0) (fixlet:16)
At 08:41:04 +0200 -
Error building fixlet relevance for report: FileIOError
Error building or posting report: FileIOError
At 08:42:10 +0200 -
Error building fixlet relevance for report: FileIOError
Error building or posting report: FileIOError
At 08:43:14 +0200 -
Error building fixlet relevance for report: FileIOError
Error building or posting report: FileIOError
At 08:44:22 +0200 -
Error building fixlet relevance for report: FileIOError
Error building or posting report: FileIOError
At 08:45:29 +0200 -
Error building fixlet relevance for report: FileIOError
Error building or posting report: FileIOError
At 08:46:34 +0200 -
Error building fixlet relevance for report: FileIOError
Error building or posting report: FileIOError
At 08:47:39 +0200 -
Error building fixlet relevance for report: FileIOError
Error building or posting report: FileIOError
At 08:48:44 +0200 -
Error building fixlet relevance for report: FileIOError
Error building or posting report: FileIOError
At 08:49:09 +0200 -
MFE: Turning FileIOError into MessageFileError in NotationFile::Write (FileIOError)
MFE: Turning FileIOError into MessageFileError in NotationFile::Write (FileIOError)
MFE: Turning FileIOError into MessageFileError in NotationFile::Write (FileIOError)
Gather::SyncSite caught FileIOError (11) FileIOError

2

Hope that meanwhile you opened a support case

3

As @orbiton suggested you are better off opening support case but for what is worth the errors are strictly writing to disk, so I would look into stuff like:

  1. is there enough disk space in /var/opt for BigFix to write to its own structure?
  2. Do you have any special file/folder permissions/other restrictions that would prevent the agent from writing to its own file/folder structure?
4

I am getting the same issue:
MFE: Turning FileIOError into MessageFileError in NotationFile::Write (FileIOError)
Error building fixlet relevance for report: FileIOError
Error building or posting report: FileIOError

This is only on AIX 7.2 after upgrading to 11.0.0.175. My AIX Relays appear to be having issues as well.
No issues with Windows or Linux clients. Linux Relays are experiencing no issues.

I am continuing to look deeper.

5

This is a know problem: KB0107385. Not sure if already published or in draft: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0107385

I will report an abstract here

AIX Client v11 may stop working

Observed Behavior
Sometimes the AIX Client (version 11.0.0.175) leaves the file descriptors opened, causing the ulimit to be reached and client to stop working correctly. The behavior was especially observed on those machine subscribed to IBM License Reporting (ILMT) site.

Workaround
Downgrade to latest AIX Client version 10.0.x or contact HCL BigFix support.

We are actively working on it. Best option is to stay with latest v10 client for now.
If you really need to run with v11, open a support ticket and we can provide a testfix.

Regards.

3 Likes
6

Hello,

Thanks for your reply.
Your link seems to be wrong “Knowledge record not found”. Do I need to login ?

For the AIX client downgrade, is it compatible with a v11 server ?

Thanks for your help.

7

Unless you enable new SHA-384 (unsupported on v10 clients), you can safely use v10 clients in a v11 infrastructure.

8

Perfect, I only enable the “default” enhanced security which is SHA-256.
Thanks a lot.

9

Any word on a fix for this other than downgrading to 10.0.9.21?

Is this issue only isolated to Aix 7.2?

10

The issue is about Clients (and potentially Relays) v11.0.0 on AIX (all supported OS versions); it will be fixed for sure on v11.0.1, not sure about hotfix availability on v11.0.0.
If you actually need to run v11, then please contact HCL Support.