RHEL patches not applicable

vicky · September 1, 2015, 2:37pm

Hi,

I’ve recently deployed a client on RHEL 5 and manually check for the updates on the server. What I found that old versions of RPM’s are installed on server and BigFix suppose to identify those updates. But there is not even a single relevant fixlet showing in BigFix server. I activated an analysis to view installed RPM’s but not even a single package is displayed in console.

I’ve subscribed the endpoint to all the relevant Linux patching support sites as well. Then I tried enable USGCB CHECKLIST FOR RHEL 5 and the fixlets of that RHEL server are shown as relevant.

For convenience I’m attaching a log file and screen shot as well.Can anyone please identify what is wrong with that(mentioning that I’m facing same issue with both RHEL endpoints).

Below is the Log file of client :

Current Date: September 1, 2015
Client version 9.2.0.363 built for RedHat 5 x86_64
Current Balance Settings: Use CPU: True Entitlement: 0 WorkIdle: 10 SleepIdle: 480
ICU data directory: ‘/var/opt/BESClient’
ICU init status: SUCCESS
ICU report character set: UTF-8
ICU fxf character set: UTF-8
ICU local character set: UTF-8
ICU transcoding between fxf and local character sets: DISABLED
ICU transcoding between report and local character sets: DISABLED
At 16:06:51 +0500 -
Starting client version 9.2.0.363
FIPS mode disabled by default.
Cryptographic module initialized successfully.
Using crypto library libBEScrypto - OpenSSL 1.0.1h-fips 5 Jun 2014
Restricted mode
Beginning Relay Select
At 16:06:52 +0500 -
RegisterOnce: Attempting secure registration with ‘https://Viftech-POC.pk.Viftech.int:52311/cgi-bin/bfenterprise/clientregister.exe?RequestType=RegisterMe&ClientVersion=9.2.0.363&Body=0&SequenceNumber=10&MinRelayVersion=7.1.1.0&CanHandleMVPings=1&Root=http://Viftech-POC.pk.Viftech.int%3A52311&AdapterInfo=00-1d-09-20-fc-d5_10.1.103.0%2F24_10.1.103.102_0&AdapterInfo=00-15-17-59-97-6a_192.168.11.0%2F24_192.168.11.88_0&AdapterInfo=00-1d-09-20-fc-d3_192.168.13.0%2F24_192.168.13.88_0&AdapterIpv6=00-1d-09-20-fc-d5^fe80%3A%3A21d%3A9ff%3Afe20%3Afcd5%2F64_0&AdapterIpv6=00-1d-09-20-fc-d3^fe80%3A%3A21d%3A9ff%3Afe20%3Afcd3%2F64_0&AdapterIpv6=00-15-17-59-97-6a^fe80%3A%3A215%3A17ff%3Afe59%3A976a%2F64_0’
Unrestricted mode
Scheduling client reset; Computer id changed to 15503991
Configuring listener without wake-on-lan
Registered with url ‘https://Viftech-POC.pk.Viftech.int:52311/cgi-bin/bfenterprise/clientregister.exe?RequestType=RegisterMe&ClientVersion=9.2.0.363&Body=0&SequenceNumber=10&MinRelayVersion=7.1.1.0&CanHandleMVPings=1&Root=http://Viftech-POC.pk.Viftech.int%3A52311&AdapterInfo=00-1d-09-20-fc-d5_10.1.103.0%2F24_10.1.103.102_0&AdapterInfo=00-15-17-59-97-6a_192.168.11.0%2F24_192.168.11.88_0&AdapterInfo=00-1d-09-20-fc-d3_192.168.13.0%2F24_192.168.13.88_0&AdapterIpv6=00-1d-09-20-fc-d5^fe80%3A%3A21d%3A9ff%3Afe20%3Afcd5%2F64_0&AdapterIpv6=00-1d-09-20-fc-d3^fe80%3A%3A21d%3A9ff%3Afe20%3Afcd3%2F64_0&AdapterIpv6=00-15-17-59-97-6a^fe80%3A%3A215%3A17ff%3Afe59%3A976a%2F64_0’
Registration Server version 9.2.0.363 , Relay version 9.2.0.363
Relay does not require authentication.
Completed automatic client authentication key exchange.
Client has an AuthenticationCertificate
Created mailboxsite and marking to gather
Client resetting
At 16:06:53 +0500 -
Unrestricted mode
Created mailboxsite and marking to gather
At 16:06:54 +0500 -
PollForCommands: Requesting commands
PollForCommands: commands to process: 1
Entering service loop
At 16:06:55 +0500 - actionsite (http://Viftech-POC.pk.Viftech.int:52311/cgi-bin/bfgather.exe/actionsite)
Downloaded ‘http://Viftech-POC.pk.Viftech.int:52311/bfmirror/bfsites/manydirlists_1/__fullsite_b888b29826bb53dc531437e723738383d8339b56’ as ‘__TempUpdateFilename’
Gather::SyncSiteByFile adding files - count: 42
At 16:06:55 +0500 -
Successful Synchronization with site ‘actionsite’ (version 80) - ‘http://Viftech-POC.pk.Viftech.int:52311/cgi-bin/bfgather.exe/actionsite’
Site ‘mailboxsite’ is not yet available on selected relay. Awaiting notification of availability.
Successful Synchronization with site ‘mailboxsite’ (version 0) - ‘http://Viftech-POC.pk.Viftech.int:52311/cgi-bin/bfgather.exe/mailboxsite15503991’
SetupListener success: IPV4/6
GatherHashMV command received.
Already have this version of site.
At 16:06:55 +0500 - actionsite (http://Viftech-POC.pk.Viftech.int:52311/cgi-bin/bfgather.exe/actionsite)
Relevant - Universal Properties (fixlet:3)
Relevant - Subscribe to Site http://sync.bigfix.com/cgi-bin/bfgather/patchingsupport (fixlet:2130714582)
Relevant - Subscribe to Site http://sync.bigfix.com/cgi-bin/bfgather/bigfixlabs (fixlet:2130715719)
Relevant - Subscribe to Site http://sync.bigfix.com/cgi-bin/bfgather/bessupport (fixlet:2130706433)
Relevant - Subscribe to Site http://sync.bigfix.com/cgi-bin/bfgather/assetdiscovery (fixlet:2130709539)
Relevant - Subscribe to Site http://Viftech-POC.pk.Viftech.int:52311/cgi-bin/bfgather.exe/actionsite (fixlet:2131900143)
Relevant - (fixlet:4)
Relevant - (fixlet:5)
Relevant - (fixlet:6)
Relevant - (fixlet:7)
Relevant - (fixlet:8)
Relevant - (fixlet:9)
Relevant - (fixlet:10)
Relevant - (fixlet:11)
Relevant - (fixlet:12)
Relevant - (fixlet:13)
Relevant - (fixlet:14)
Relevant - (fixlet:15)
Relevant - (fixlet:16)
Relevant - (fixlet:17)
Relevant - (fixlet:18)
Relevant - (fixlet:19)
Relevant - (fixlet:20)
Relevant - (fixlet:21)
Relevant - (fixlet:22)
Relevant - (fixlet:23)
Relevant - (fixlet:24)
Relevant - (fixlet:26)
Relevant - (fixlet:27)
Relevant - (fixlet:28)
Relevant - (fixlet:29)
Relevant - (fixlet:30)
Relevant - (fixlet:31)
Relevant - (fixlet:32)
Relevant - (fixlet:33)
Relevant - (fixlet:34)
Start monitoring action - Heartbeat Analysis (fixlet:2)
Relevant - Installed Windows Patches Information (fixlet:37)
Relevant - custom analysis (fixlet:46)
At 16:06:55 +0500 -
ActionLogMessage: (action:2130706433) Action signature verified for Execution
ActionLogMessage: (action:2130706433) starting action
At 16:06:55 +0500 - actionsite (http://Viftech-POC.pk.Viftech.int:52311/cgi-bin/bfgather.exe/actionsite)
Command succeeded (evaluated true) continue if {sha1 of file “BES Support.efxm” of client folder of site “http://Viftech-POC.pk.Viftech.int:52311/cgi-bin/bfgather.exe/actionsite” = “27bfdc5b60d589ae52a6b8d28a9dc5ca2a58f203”} (action:2130706433)
Command succeeded subscribe “BES Support.efxm” (action:2130706433)
Not Relevant - Subscribe to Site http://sync.bigfix.com/cgi-bin/bfgather/bessupport (fixlet:2130706433)
At 16:06:55 +0500 -
ActionLogMessage: (action:2130706433) ending action
Encryption: optional encryption with no certificate; reports in cleartext
Full Report posted successfully
At 16:06:56 +0500 - BES Support (http://sync.bigfix.com/cgi-bin/bfgather/bessupport)
Downloaded ‘http://Viftech-POC.pk.Viftech.int:52311/bfmirror/bfsites/enterprisemirror_2_1222/__fullsite’ as ‘__TempUpdateFilename’
Gather::SyncSiteByFile adding files - count: 127
At 16:06:56 +0500 -
Successful Synchronization with site ‘BES Support’ (version 1222) - ‘http://sync.bigfix.com/cgi-bin/bfgather/bessupport’
ActionLogMessage: (action:2130709539) Action signature verified for Execution
ActionLogMessage: (action:2130709539) starting action
At 16:06:56 +0500 - actionsite (http://Viftech-POC.pk.Viftech.int:52311/cgi-bin/bfgather.exe/actionsite)
Command succeeded (evaluated true) continue if {sha1 of file “BES Asset Discovery.efxm” of client folder of site “http://Viftech-POC.pk.Viftech.int:52311/cgi-bin/bfgather.exe/actionsite” = “0763f0a17b0b3d9da5e0ee50ec6d2353c81fe34f”} (action:2130709539)
Command succeeded subscribe “BES Asset Discovery.efxm” (action:2130709539)
Not Relevant - Subscribe to Site http://sync.bigfix.com/cgi-bin/bfgather/assetdiscovery (fixlet:2130709539)
At 16:06:56 +0500 -
ActionLogMessage: (action:2130709539) ending action
At 16:06:56 +0500 - BES Asset Discovery (http://sync.bigfix.com/cgi-bin/bfgather/assetdiscovery)
Site level relevance is now: True for relevance ‘(if (name of operating system starts with “Win”) then platform id of operating system != 3 else (name of operating system as lowercase contains “linux”)) AND (if exists property “in proxy agent context” then (not in proxy agent context) else true) AND (if exists property “android” of type “operating system” then (not android of operating system) else true)’
Downloaded ‘http://Viftech-POC.pk.Viftech.int:52311/bfmirror/bfsites/enterprisemirror_3_89/__fullsite’ as ‘__TempUpdateFilename’
Gather::SyncSiteByFile adding files - count: 2
At 16:06:56 +0500 -
Successful Synchronization with site ‘BES Asset Discovery’ (version 89) - ‘http://sync.bigfix.com/cgi-bin/bfgather/assetdiscovery’
At 16:06:57 +0500 -
ActionLogMessage: (action:2130714582) Action signature verified for Execution
ActionLogMessage: (action:2130714582) starting action
At 16:06:57 +0500 - BES Asset Discovery (http://sync.bigfix.com/cgi-bin/bfgather/assetdiscovery)
Relevant - Designate Nmap Scan Point - Red Hat Enterprise Linux | CentOS (fixlet:236)
At 16:06:57 +0500 - BES Support (http://sync.bigfix.com/cgi-bin/bfgather/bessupport)
BackgroundAdviceEvaluation SkipMessageFile optimization of Libraries.fxf
At 16:06:57 +0500 - actionsite (http://Viftech-POC.pk.Viftech.int:52311/cgi-bin/bfgather.exe/actionsite)
Command succeeded (evaluated true) continue if {sha1 of file “Patching Support.efxm” of client folder of site “http://Viftech-POC.pk.Viftech.int:52311/cgi-bin/bfgather.exe/actionsite” = “b5d24ac07d03c160848ba3f136915afa0981ab08”} (action:2130714582)
Command succeeded subscribe “Patching Support.efxm” (action:2130714582)
Not Relevant - Subscribe to Site http://sync.bigfix.com/cgi-bin/bfgather/patchingsupport (fixlet:2130714582)
At 16:06:57 +0500 -
ActionLogMessage: (action:2130714582) ending action
At 16:06:57 +0500 - Patching Support (http://sync.bigfix.com/cgi-bin/bfgather/patchingsupport)
Site level relevance is now: True for relevance '(if exists property “in proxy agent context” then ( not in proxy agent context ) else true ) AND (if exists property “android” of type “operating system” then ( not android of operating system ) else true ) ’
Downloaded ‘http://Viftech-POC.pk.Viftech.int:52311/bfmirror/bfsites/enterprisemirror_10_385/__fullsite’ as ‘__TempUpdateFilename’
Gather::SyncSiteByFile adding files - count: 37
At 16:06:57 +0500 -
Successful Synchronization with site ‘Patching Support’ (version 385) - ‘http://sync.bigfix.com/cgi-bin/bfgather/patchingsupport’
ActionLogMessage: (action:2130715719) Action signature verified for Execution
ActionLogMessage: (action:2130715719) starting action
At 16:06:57 +0500 - actionsite (http://Viftech-POC.pk.Viftech.int:52311/cgi-bin/bfgather.exe/actionsite)
Command succeeded (evaluated true) continue if {sha1 of file “BigFix Labs.efxm” of client folder of site “http://Viftech-POC.pk.Viftech.int:52311/cgi-bin/bfgather.exe/actionsite” = “e463e9546e645e0f0f9270431729e78b81db0eee”} (action:2130715719)
Command succeeded subscribe “BigFix Labs.efxm” (action:2130715719)
Not Relevant - Subscribe to Site http://sync.bigfix.com/cgi-bin/bfgather/bigfixlabs (fixlet:2130715719)
At 16:06:57 +0500 -
ActionLogMessage: (action:2130715719) ending action
At 16:06:58 +0500 - BigFix Labs (http://sync.bigfix.com/cgi-bin/bfgather/bigfixlabs)
Site level relevance is now: True for relevance ‘if( name of operating system starts with “Win” ) then platform id of operating system != 3 AND (if exists property “in proxy agent context” then (not in proxy agent context) else true) else true’
Downloaded ‘http://Viftech-POC.pk.Viftech.int:52311/bfmirror/bfsites/enterprisemirror_16_45/__fullsite’ as ‘__TempUpdateFilename’
Gather::SyncSiteByFile adding files - count: 4
At 16:06:58 +0500 -
Successful Synchronization with site ‘BigFix Labs’ (version 45) - ‘http://sync.bigfix.com/cgi-bin/bfgather/bigfixlabs’
ActionLogMessage: (action:2131900143) Action signature verified for Execution
ActionLogMessage: (action:2131900143) starting action
At 16:06:58 +0500 - actionsite (http://Viftech-POC.pk.Viftech.int:52311/cgi-bin/bfgather.exe/actionsite)
Command succeeded (evaluated true) continue if {sha1 of file “ActionSite.afxm” of client folder of site “http://Viftech-POC.pk.Viftech.int:52311/cgi-bin/bfgather.exe/actionsite” = “0196d02cf479033b4b5446d83c6bff093157f798”} (action:2131900143)
At 16:06:58 +0500 -
FIPS mode disabled by default.
Cryptographic module already initialized.
Unrestricted mode
At 16:06:58 +0500 - actionsite (http://Viftech-POC.pk.Viftech.int:52311/cgi-bin/bfgather.exe/actionsite)
Command succeeded subscribe “ActionSite.afxm” (action:2131900143)
Not Relevant - Subscribe to Site http://Viftech-POC.pk.Viftech.int:52311/cgi-bin/bfgather.exe/actionsite (fixlet:2131900143)
At 16:06:58 +0500 -
ActionLogMessage: (action:2131900143) ending action
Successful Synchronization with site ‘actionsite’ (version 80) - ‘http://Viftech-POC.pk.Viftech.int:52311/cgi-bin/bfgather.exe/actionsite’
At 16:06:59 +0500 - BES Support (http://sync.bigfix.com/cgi-bin/bfgather/bessupport)
Relevant - Install IBM Endpoint Manager Relay on Linux and UNIX (Version 9.2.0) (Superseded) (fixlet:1846)
Relevant - Updated Red Hat Enterprise Linux Client - IBM Endpoint Manager version 9.2.1 Now Available! (Superseded) (fixlet:1888)
Relevant - Updated Red Hat Enterprise Linux Client - IBM Endpoint Manager version 9.2.5 Now Available! (fixlet:1998)
Relevant - BES Component Versions (fixlet:204)
Relevant - BES Relay Status (fixlet:205)
Relevant - BES Management Rights (fixlet:212)
Relevant - Bandwidth Throttling Status (fixlet:218)
Relevant - Wake-on-LAN Analysis (fixlet:840)
Relevant - BES Client Setting: Relay Selection Controls (fixlet:154)
Relevant - BES Client Setting: Enable Debug Logging (fixlet:157)
Relevant - BES Client Setting: Download Throttling (fixlet:167)
Relevant - BES Client Setting: CPU Usage (fixlet:168)
Relevant - BES Client Setting: Enable Auto Relay Selection (fixlet:292)
Relevant - BES Client Setting: Lock Computer (fixlet:295)
Relevant - BES Client Setting: Remove Arbitrary Client Setting (fixlet:310)
Relevant - BES Client Setting: Encrypted Reports (fixlet:543)
Relevant - BES Client Setting: Designate Wake-on-LAN Forwarders (fixlet:571)
Relevant - BES Client Setting: Enable/Disable Dynamic Throttling (fixlet:605)
Relevant - BES Client Setting: Client UI Minimum Analysis Interval (fixlet:651)
Relevant - BES Client Setting: Enable Command Polling (fixlet:688)
Relevant - TROViftechESHOOTING: Restart BES Client on RHEL/SUSE (fixlet:514)
Relevant - TROViftechESHOOTING: Run BES Client Diagnostics (Linux/UNIX/Mac) (fixlet:655)
Relevant - TROViftechESHOOTING: Enable BES Client Usage Profiler (fixlet:361)
Relevant - Force BES Clients to Run Manual Relay Selection (fixlet:432)
Relevant - Switch BES Client Action Site Masthead - BES >= 9.0 (fixlet:1516)
Relevant - TROViftechESHOOTING: Reset the BES Client - BES >= 9.0 (fixlet:1976)
At 16:06:59 +0500 - BigFix Labs (http://sync.bigfix.com/cgi-bin/bfgather/bigfixlabs)
BackgroundAdviceEvaluation::FinishDataLoop side line file Ubuntu Packages.fxf
Relevant - CVE-2014-0160 - OpenSSL TLS Heartbeat Read Overrun Vulnerability Scanner (fixlet:9001)
At 16:06:59 +0500 - Patching Support (http://sync.bigfix.com/cgi-bin/bfgather/patchingsupport)
Relevant - Repository Configuration - Red Hat Enterprise Linux (fixlet:12)
Relevant - “Shell Shock” bash Vulnerability (CVE-2014-7169) Status (fixlet:1829)
Relevant - Enable custom repository support - Red Hat Enterprise Linux (fixlet:13)
Relevant - Install packages by using yum (fixlet:18)
Relevant - Check for “Shell Shock” bash Vulnerability (CVE-2014-7169) (fixlet:1828)
At 16:07:57 +0500 -
Report posted successfully

vicky · September 1, 2015, 2:39pm

@steve @TimRice @jmaple @vikki need help.

jmaple · September 1, 2015, 3:04pm

Is your client subscribed to the RHEL5 patching site?

vicky · September 1, 2015, 6:08pm

Hi @jmaple

Yes the client is subscribed to RHEL 5 patching site and also for Native tool and Dependency resolution site and also to the Linux RPM Patching site.
Though client is not updated and it need updates to critical packages like SSH, SNMP, SAMBA etc because I manually check the system and all the rpm installed on it are outdated and need to be updated. My Query is that these fixes should be applicable to the client and the analysis is also not fetching the list of installed RPM’s.

Wondering that we haven’t patched that system for many time and the patches are needed on the client. Is there any exception occurred that preventing client to become applicable to those fixes and analysis? Any service that need to be start or anything else?

jmaple · September 1, 2015, 6:35pm

Well all the fixlets from the RHEL patching sites query RPM to determine relevance. I have a similar issue on a few servers of mine and I can only assume, at this point, it could be the version of RPM that IEM can’t query? I have another thread asking about how the RPM inspector works.

vicky · September 2, 2015, 5:57am

@jmaple did you subscribe your RHEL server to the other sites like “USGCB Checklist” or “DISA Checklist”

Can you please specify which service need to be running which require BigFix server to query Rpm database?

vicky · September 2, 2015, 6:03am

Have you check that analysis like “Installed RPM packages” are working?
Because in my case this analysis is not fetching the list of installed RPM as well.

jmaple · September 2, 2015, 12:09pm

Well there are no particular sites in question here. There is a relevance inspector that handles this. The inspector is what doesn’t seem to be working correctly on these servers. The analysis you allude to does not have any results. The result is 0.