Site gather issue (bessupport)

Hello

I cannot complete the installation of a new 9.5.5 bigfix for 2 weeks. (I tried it 5 times in different environments.)

After installation, bessupport cannot be gathered. When I choose evaluation mode, all other sites can be gathered except bessupport. if I select production mode, bessupport should be gathered succesfully first, but it cannot be done.

this is the error that I get on every try. this is the vm on my laptop. I tried with win2012 and win2016. I tried it at different locations (at office or at home). there is no proxy.

I also monitoring the folder “C:\Program Files (x86)\BigFix Enterprise\BES Server\wwwrootbes\bfmirror\bfsites\enterprisemirror_3_1348” during the gather process. there are 1.775 items in folder. In every gather attempt, this folder is emptied and all items are downloaded again and 1775 items remain after every fail.

these are error log in file “BESRelay.log”
Sun, 25 Jun 2017 06:14:36 +0300 - 3904 - 3: Unable to get site content (failed to pass sha1 hash value checks).
Sun, 25 Jun 2017 06:39:17 +0300 - 4440 - 3: Unable to get site content (failed to pass sha1 hash value checks).

and these are the logs in file “GatherDB.log”
Sun, 25 Jun 2017 06:24:38 +0300 – Unexpected exception during gather of site BES Support: Unexpected HTTP response: 404
Sun, 25 Jun 2017 06:39:18 +0300 – Unexpected exception during gather of site BES Support: Unexpected HTTP response: 404

how to workaround this ?

I tried to get it by airgap on the same server.

I successfully gathered the site (with all 1777 items). I think the problem causes from the file “jquery-ui-1.8.17.js”. it’s actual hash does not match the one as described in page “http://sync.bigfix.com/cgi-bin/bfgather/bessupport”. (I downloaded it seperately and checked its sha1 and verified they dont match.)

GatherDB.log

Sun, 25 Jun 2017 07:40:26 +0300 – Invalid file: jquery-ui-1.8.17
Sun, 25 Jun 2017 07:40:28 +0300 – Unexpected exception during gather of site BES Support: class GatheredFilesNotVerified
Sun, 25 Jun 2017 07:41:28 +0300 – Invalid file: jquery-ui-1.8.17
Sun, 25 Jun 2017 07:41:30 +0300 – Unexpected exception during gather of site BES Support: class GatheredFilesNotVerified
Sun, 25 Jun 2017 07:42:35 +0300 – Invalid file: jquery-ui-1.8.17
Sun, 25 Jun 2017 07:42:37 +0300 – Unexpected exception during gather of site BES Support: class GatheredFilesNotVerified
Sun, 25 Jun 2017 07:47:59 +0300 – Invalid file: jquery-ui-1.8.17
Sun, 25 Jun 2017 07:48:01 +0300 – Unexpected exception during gather of site BES Support: class GatheredFilesNotVerified

I passed the issue by downloading the file by using “https://sync.bigfix.com/bfsites/bessupport_1348/jquery-ui-1.8.17.js” and copying it to “C:\Program Files (x86)\BigFix Enterprise\BES Server\wwwrootbes\bfmirror\bfsites\enterprisemirror_3_1348”

https://sync.bigfix.com/bfsites/bessupport_1348/jquery-ui-1.8.17.js - sha1 matches with the value in manifest file
http://sync.bigfix.com/bfsites/bessupport_1348/jquery-ui-1.8.17.js - sha1 does not match with the value in manifest file

bigfix gatherer uses the url in manifest file “http://sync.bigfix.com/bfsites/bessupport_1348/jquery-ui-1.8.17.js” and it fails.

Check for the differences between files in the two URLs. It may be that a proxy server at your site is modifying the file when it is downloaded via http, but not via https (for instance some proxies will strip javascript or other tags from downloaded files).

These files look quiet different.
I think, this is not a proxy issue.

could you check it on your side ?

https://sync.bigfix.com/bfsites/bessupport_1348/jquery-ui-1.8.17.js
http://sync.bigfix.com/bfsites/bessupport_1348/jquery-ui-1.8.17.js

check the end of files, please

I got the identical file from both URL.

then, I may be directed to a different instance of synch.bigfix.com

The different servers should have the exact same version. The most common issue is an IPS that will block the JS files sometimes. Does your environment have an IPS (Intrusion Protection System)

1 Like

The files are identical for me as well.

Can you do a diff of the two files? I wonder whether your Internet connection is compromised.

https://www.diffchecker.com/zmNBO4g6

left one is the one which I get from https site

1 Like

and now, they are identical for me too

Neat site!

The files look more or less the same to me, but reordered, like they were #included from somewhere in a different order maybe.

We’ve pointed at your proxy a couple of times now, are you using a proxy server? I wonder whether your proxy server had cached an older version for some period until it timed out? But from the site info you’re showing it doesn’t look like the file was updated recently. Really odd.

two days ago I can see it is fixed while I am using my mobile celluar network.
but today, we are at office (there is no proxy), I and my two colleagues tried to get this file “http://sync.bigfix.com/bfsites/bessupport_1348/jquery-ui-1.8.17.js” and we are getting the old (wrong) file again. one of my colleague have tried this link firstly.

It is obvious that the old page (file) is cached in somewhere and that this is a local problem.
We dont have proxy in the office but I dont know the things in our ISP.

The problem is not being encountered when we use https or opera vpn. interesting, who does proxy us ? :relaxed:

In my environment, first thought would be “The Russians!”. But it may be your internet provider.

If you don’t have an internal infosec team then I’d suggest you bring this up with your ISP immediately.