BigFix Agent disappears after KB4056892

[ovsd.ptran]

After installing the cumulative update that addresses the “Meltdown” issue, our 9.5.7 clients are getting unregistered from Services and aren’t starting up. We are running v1709; have to reinstall the client once this happens to get it to work.

Any ideas?

[jgstew]

That shouldn’t happen.

Can you tell what state the client is in when it is in this broken state?

Can you provide any log details with root server / relay / similar details removed?

You should probably file a PMR to get direct support: How to ask for IBM product help: PMRs, RFEs, and more

[ovsd.ptran]

Alright. I was thinking maybe someone could provide some quick insight into this. I’ll do that - thanks.

[jgstew]

I might be able to provide some insight with more details, like any client logs or client service logs or similar.

Does the BigFix client service still exist on the machine? does it start? is it running?

If the service runs but the client won’t talk to the root, then the client logs are going to be the most helpful. If the service doesn’t run at all, then the regular client logs probably won’t be useful.

[Dave_L]

try re registering the besclient service to see if that fixes it…if not open a PMR

[ovsd.ptran]

So…here is a screenshot of what is left in the BES Client folder. A MSI Repair fixes this, but…nothing for me to generate logs from.

[jgstew]

what antivirus are you using? I don’t really understand how the client EXE could just disappear like that unless it was being removed by something external to the client itself.

The logs folder would be here on x64 systems: C:\Program Files (x86)\BigFix Enterprise\BES Client\__BESData\__Global\Logs

It might be useful to have the last 100 lines of the newest log from that folder (with stuff like root server removed) to see what the client did just before this happened.

[AlexaVonTess]

FYI: I’ve tested this and did NOT see the issue. I remotely watched the BES log via BareTail.exe and all looked normal during and after reboot.

Fixlet ID: 405689205 MS18-JAN: Delta Update for Windows 10 Version 1709 - Windows 10 Version 1709 - Delta Update - KB4056892 (x64)018

Agent: 9.5.7.94

Antivirus: Kaspersky Endpoint Security SP2 MR1

[ovsd.ptran]

Thanks everyone. I think we’ve decided just to upgrade to 9.5.8 - basically reinstalling/upgrading BigFix via GPO or by fixlet seems to solve it. Although now I’m trying to do this by CDT, and I guess it’s better to Nmap it first, but…Nmap Asset Discovery not relevant