SSA giving alerts for updates that are not sent to that PC

[shoerman]

We are looking to start using SSA “selfservice application” and we are testing it. We are seeing a strange thing happen, we are getting alerts of windows updates to install, but there are none when you open up the SSA.
it does not seem to happen on all machines, but enough to make it worrying if we start using it.
We had one today where the server team sent a baseline of windows updates to a dynamic group of servers, windows workstations that have the SSA installed were getting popups that updates were available, but if you opened the SSA there were no updates showing up. we did not see this behavior with the Bigfix support center before the SSA was installed. This behavior only showed up after SSA was installed on a machine. not sure it makes a difference, but our Bes is on Patch 13.

any ideas what might be causing this?

[shoerman]

More information; we have narrowed it down to; if you send a fixlet to a computer group manual or dynamic, a computer with SSA installed that is not in that group, will get the notification, but will not show that offer.
This does not happen to all machines with SSA installed, but it is happening on 4 of the 10 machines we are testing SSA with.

[JasonWalker]

Are you seeing the message in the client log, or getting a windows system tray popup, or a message somewhere else? I’m not clear on what you’re seeing from the description

[lgimondo]

Which version of SSA do you have ?
SSA shows messages in these cases :

• In Take Action dialog if you selected “Display message while running action” of Message tab
  A message is shown when the action/baseline starts and at the end of the execution it
  disappears and another one shows the the action is completed
• In Take Action dialog if you selected “Display message before running action” of Message tab
  A message with a red flag that indicates that this is a Required action is shown. Is this the
  message you are referring to ? Something like this
  
  Does the action run automatically at the deadline ?
• In Take Action dialog if you selected Restart / Shutdown of Post-Action tab you should see
  

In all cases SSA shows the related card in the catalog. After executing a required action SSA shows the action as completed, but if you close and open SSA, this info is removed from the catalog and you can find it in the history.

[shoerman]

The machines that have the issue were on SSA 3.0.0 we have upgrade them to 3.0.2 and they still have the issue.
An offer sent with a message and with out a message, it does not matter the affected machines still get a popup saying there is an offer available.
Just to be clear we are not sending the offers to the machines that are getting the balloons that say a new offer is available, that is the odd part, if they are not being targeted why are they picking up offer notices sent to other machines. As you would expect when they click on the balloon and open SSA there is nothing there. we have tried packages IBM/HCL built-in packages like windows updates and application updates and we have also tried our own packages, the result is the same SSA is indicating offers that were not sent to them. we are also now seeing this issue on Mac’s with SSA installed. Screen shot from a Mac it is getting offer notifications for servers and windows workstations, there is relevance on these packages to limit them to windows OS and the Mac’s are in a completely different site.

[shoerman]

here is a section of log file there is this repeating no correlation tag

[10:37:15.472] Offer 490591 has no correlation tag
[10:37:15.472] New Offer: IT: Servicing Stack Update for Windows 2019 Servers ONLY - May 2019. (490596)
[10:37:15.472] Offer 490596 has no correlation tag
[10:37:15.472] Retrieving history from Thu, 21 Feb 2019 09:37:15 -0500 to Wed, 22 May 2019 10:37:15 -0400
[10:40:08.405] New Offer: IT: Required Office Updates - Pre-2018. (490598)
[10:40:08.406] Offer 490598 has no correlation tag
[10:40:08.407] Retrieving history from Thu, 21 Feb 2019 09:40:08 -0500 to Wed, 22 May 2019 10:40:08 -0400
[10:45:27.364] New Offer: IT: Pre-2018 Important Required Windows Updates. (490817)
[10:45:27.367] Offer 490817 has no correlation tag
[15:04:15.153] New Offer: IT: Pre-2018 Critical Required Windows Updates. (491185)
[15:04:15.154] Offer 491185 has no correlation tag
[15:04:15.154] New Offer: IT: Pre-2018 Critical Required Windows Updates. (491220)
[15:04:15.154] Offer 491220 has no correlation tag
[15:04:15.155] New Offer: IT: Servicing Stack Update for Windows 2016 Servers ONLY - May 2019. (491287)
[15:04:15.155] Offer 491287 has no correlation tag
[15:04:15.157] New Offer: IT: Recommended SQL Server Application Updates - May 2019. (491290)
[15:04:15.158] Offer 491290 has no correlation tag
[15:04:15.158]

[lgimondo]

I think that “no correlation tag” log is not an issue.
I suppose that you are submitting the offer with “Notify users of offer availability” but the offers are not relevant on the agent. In this case it is correct that you do not see the offer in the Catalog, but the notification should not be fired since they are not relevant Offers. could you check if it is a correct assumption ?

[shoerman]

Correct we are checking the “notify users of the offer availability”.
you are correct the no correlation tag does not mean anything, it just means it was not meant for that machine.
but I did notice after checking logs from machines that do have the issue and machines that do not have the issue. one of the offers notifications that showed up was an application update named "server only…"
On the machines that have the issue this shows up in the logs, for the machines that do not have the issue there is no mention of this offer.

[lgimondo]

It seems to be a bug because notifications should not be fired on not relevant offers.
Please open a PMR

[shoerman]

Thank you all very much for your help we will open a PMR.