Upgrade agents 3.3.3 -> 3.4.4 -> 4.0.2 with action rule failing

L0 Member

Upgrade agents 3.3.3 -> 3.4.4 -> 4.0.2 with action rule failing

Hi

 

We have upgraded ESM Core and Console to version 4.0.2. Our clients have version 3.3.3 and we neeed to upgrade to 3.4.X at first i believe? But it is failing. Any idea? I have created action rules for upgrade.

 

2017-08-11 09:30:12.9387	INFO	CyveraService	21	Cyvera.Client.Service.Processes.InjectedProcessReporter	General	Removing closed process IDs: 18364 
2017-08-11 09:30:13.0423	INFO	CyveraService	19	Cyvera.Client.Service.Policy.PolicyManagerBase	Action	Received 1 actions 
2017-08-11 09:30:13.0423	DEBUG	CyveraService	19	Cyvera.Client.Service.OneTimeActions.ActionManager	Action	Saving action storage to C:\ProgramData\Cyvera\LocalSystem\Actions.xml 
2017-08-11 09:30:13.0423	INFO	CyveraService	19	Cyvera.Client.Service.Policy.PolicyManagerBase	Action	Finished handling actions, updating actions version to 524 
2017-08-11 09:30:13.0493	INFO	CyveraService	35	Cyvera.Client.Service.OneTimeActions.OneTimeActionsExecuter	Action	Executing one time action of type InstallUpdate, ID 10874 
2017-08-11 09:30:13.0493	DEBUG	CyveraService	19	Cyvera.Client.Service.OneTimeActions.ActionManager	Action	Saving action storage to C:\ProgramData\Cyvera\LocalSystem\Actions.xml 
2017-08-11 09:30:13.0493	INFO	CyveraService	35	Cyvera.Client.Service.OneTimeActions.OneTimeActionBase	Action	Executing action of type InstallUpdate with id 10874 
2017-08-11 09:30:13.0493	INFO	CyveraService	35	Cyvera.Client.Service.OneTimeActions.Actions.InstallUpdateAction	Action	Upgrade file URL: 'http://xxx.xxx.local/EndpointSecurityManager/Update/3.4.4.24430/x64', local directory: 'C:\ProgramData\Cyvera\Everyone\Temp\Update_10874' 
2017-08-11 09:30:13.0493	INFO	CyveraService	35	Cyvera.Common.General.Extensions.WebExtensions	General	Starting to download file downloading file http://xxx.xxx.local/EndpointSecurityManager/Update/3.4.4.24430/x64, to directory C:\ProgramData\Cyvera\Everyone\Temp\Update_10874, Timeout set to 60 seconds 
2017-08-11 09:30:13.0493	INFO	CyveraService	19	Cyvera.Client.Service.Policy.PolicyManagerBase	Policy	Calling GetPolicyFinal... 
2017-08-11 09:30:13.5431	DEBUG	CyveraService	19	Cyvera.Client.Service.Policy.PolicyManagerBase	Policy	Persisting policy 
2017-08-11 09:30:13.5947	INFO	CyveraService	19	Cyvera.Client.Service.Policy.PolicyManagerBase	Policy	Updating policy version to 350 
2017-08-11 09:30:13.5947	DEBUG	CyveraService	19	Cyvera.Client.Service.Policy.PolicyManagerBase	Policy	Notifying system of policy change 
2017-08-11 09:30:13.5947	DEBUG	CyveraService	19	Cyvera.Client.Service.Policy.PolicyManagerBase	Policy	Updating policy in registry. 
2017-08-11 09:30:13.5947	INFO	CyveraService	19	Cyvera.Client.Service.Policy.PolicyRegistryWriter	Policy	Try to delete policy tree - OnPolicyUpdating 
2017-08-11 09:30:13.5947	INFO	CyveraService	19	Cyvera.Client.Service.Policy.PolicyRegistryWriter	Policy	Call WritePolicyToRegistry 
2017-08-11 09:30:13.5962	INFO	CyveraService	19	Cyvera.Client.Service.Policy.PolicyRegistryWriter	Policy	Call WriteOptInsToRegistry 
2017-08-11 09:30:13.5962	INFO	CyveraService	19	Cyvera.Client.Service.Policy.PolicyRegistryWriter	Policy	tryParse defaultDisableInjection 
2017-08-11 09:30:13.7898	INFO	CyveraService	19	Cyvera.Client.Service.Policy.PolicyRegistryWriter	Policy	Call ValidateRopEntries 
2017-08-11 09:30:13.7898	INFO	CyveraService	19	Cyvera.Client.Service.Policy.PolicyRegistryWriter	Policy	Call WriteGeneratSettingsToRegistry 
2017-08-11 09:30:13.7898	INFO	CyveraService	19	Cyvera.Client.Service.Policy.PolicyRegistryWriter	Policy	Call WriteSprotToRegistry 
2017-08-11 09:30:13.8163	INFO	CyveraService	12	Cyvera.Client.Service.CyveraService	General	Start EnableStop 
2017-08-11 09:30:13.8163	INFO	CyveraService	12	Cyvera.Client.Service.CyveraService	General	Setting 'enable service stop' to True 
2017-08-11 09:30:13.8163	DEBUG	CyveraService	12	Cyvera.Client.Service.CyveraService	General	Received ControlsAccepted=197 
2017-08-11 09:30:13.8163	INFO	CyveraService	19	Cyvera.Client.Service.Policy.PolicyRegistryWriter	Policy	Try to delete policy tree, after CuApplyPolicy 
2017-08-11 09:30:13.8583	DEBUG	CyveraService	19	Cyvera.Client.Service.Policy.PolicyManagerBase	Policy	Finished updating policy in registry. 
2017-08-11 09:30:13.8583	INFO	CyveraService	19	Cyvera.Client.Service.Policy.PolicyManagerBase	Policy	Update policy from server completed. 
2017-08-11 09:30:13.8583	DEBUG	CyveraService	19	Cyvera.Client.Service.Policy.PolicyManagerBase	Policy	Update from server completed 
2017-08-11 09:30:13.8583	DEBUG	CyveraService	29	Cyvera.Client.Service.Policy.PolicyManagerBase	Policy	PolicyUpdated thread started 
2017-08-11 09:30:13.8583	DEBUG	CyveraService	19	Cyvera.Client.Service.Heartbeat.HeartbeatManager	Heartbeat	Trying to start heartbeat. Send heartbeat = True, Server address was found = True 
2017-08-11 09:30:13.8583	DEBUG	CyveraService	19	Cyvera.Client.Service.OneTimeActions.ActionManager	Action	Saving action storage to C:\ProgramData\Cyvera\LocalSystem\Actions.xml 
2017-08-11 09:30:13.8659	INFO	CyveraService	19	Cyvera.Client.Service.Policy.PolicyManagerBase	Policy	Updating policy from server, force=True 
2017-08-11 09:30:13.8659	DEBUG	CyveraService	19	Cyvera.Common.Interfaces.LicensingNew.LicenseEncryptor	General	About to decrypt license for machine 'FMHEPC-TGU017': 'fmhepc-tgu017' 
2017-08-11 09:30:13.8659	DEBUG	CyveraService	19	Cyvera.Common.General.Win32.SessionHelper	General	Found active session with user: fmhetgu 
2017-08-11 09:30:13.9814	DEBUG	CyveraService	19	Cyvera.Client.Service.Policy.PolicyManagerBase	Heartbeat	Sending heartbeat to server 
2017-08-11 09:30:14.0039	DEBUG	CyveraService	19	Cyvera.Client.Service.Policy.PolicyManagerBase	Heartbeat	Heartbeat completed successfully, continuing update from server 
2017-08-11 09:30:14.0039	INFO	CyveraService	19	Cyvera.Client.Service.Heartbeat.ServerAddressesManager	Communication	"Received 4 possible server addresses: 
Priority 1: http://xxxx.xxxx.local:2125/, https://xxxx.xxxx.local:2125/, https://xxxx.xxxx.no:2125/
Priority 2: https://xxxx.xxxx.no:2125/
 "
2017-08-11 09:30:14.0039	INFO	CyveraService	19	Cyvera.Client.Service.Policy.PolicyManagerBase	Policy	Collecting client information for policy and actions update 
2017-08-11 09:30:14.0039	INFO	CyveraService	11	Cyvera.Client.Service.Heartbeat.ClosestServerFinder	Communication	Search for 4 possible servers 
2017-08-11 09:30:14.0039	DEBUG	CyveraService	19	Cyvera.Common.General.Win32.SessionHelper	General	Found active session with user: fmhetgu 
2017-08-11 09:30:14.0039	INFO	CyveraService	19	Cyvera.Client.Service.Policy.PolicyManagerBase	Policy	Client information has changed since last heartbeat - update both policy and actions. 
2017-08-11 09:30:14.0039	INFO	CyveraService	19	Cyvera.Client.Service.Policy.PolicyManagerBase	Action	Getting actions from server... 
2017-08-11 09:30:14.0039	INFO	CyveraService	11	Cyvera.Client.Service.Heartbeat.ClosestServerFinder	Communication	"Found the following servers:
Priority=1, TTL=10, Latency=4,00ms, Address=https://xxxx.xxxx.no:2125/
Priority=1, TTL=10, Latency=3,00ms, Address=https://xxxx.xxxx.local:2125/
Priority=1, TTL=10, Latency=6,50ms, Address=http://xxxx.xxxx.local:2125/
Priority=2, TTL=10, Latency=3,50ms, Address=https://xxxx.xxxx.no:2125/
 "
2017-08-11 09:30:14.0320	INFO	CyveraService	29	Cyvera.Client.Service.Policy.GeneralSettingsEnforcer	Policy	Total storage size is 5025 MB, quota is 5120 MB 
2017-08-11 09:30:14.0320	DEBUG	CyveraService	29	Cyvera.Client.Service.EPMs.WildFire.WildFire	WildFire	On Policy Updated 
2017-08-11 09:30:14.0320	DEBUG	CyveraService	29	Cyvera.Client.Service.EPMs.WildFire.WildFire	WildFire	WildFire is enabled by policy. 
2017-08-11 09:30:14.0320	DEBUG	CyveraService	29	Cyvera.Client.Service.EPMs.WildFire.SignaturesCacheBase	WildFire	NoConnection cache count: 0 
2017-08-11 09:30:14.0320	DEBUG	CyveraService	29	Cyvera.Client.Service.Policy.PolicyManagerBase	Policy	PolicyUpdated thread ending 
2017-08-11 09:30:14.0680	INFO	CyveraService	19	Cyvera.Client.Service.Policy.PolicyManagerBase	Action	Received 0 actions 
2017-08-11 09:30:14.0680	DEBUG	CyveraService	19	Cyvera.Client.Service.OneTimeActions.ActionManager	Action	Saving action storage to C:\ProgramData\Cyvera\LocalSystem\Actions.xml 
2017-08-11 09:30:14.0680	WARN	CyveraService	19	Cyvera.Client.Service.OneTimeActions.OneTimeActionsExecuter	Action	There was an attempt to run one time actions while a one time action thread was active. 
2017-08-11 09:30:14.0680	INFO	CyveraService	19	Cyvera.Client.Service.Policy.PolicyManagerBase	Action	Finished handling actions, updating actions version to 525 
2017-08-11 09:30:14.0680	DEBUG	CyveraService	19	Cyvera.Client.Service.OneTimeActions.ActionManager	Action	Saving action storage to C:\ProgramData\Cyvera\LocalSystem\Actions.xml 
2017-08-11 09:30:14.0680	INFO	CyveraService	19	Cyvera.Client.Service.Policy.PolicyManagerBase	Policy	Calling GetPolicyFinal... 
2017-08-11 09:30:14.1831	DEBUG	CyveraService	19	Cyvera.Client.Service.Policy.PolicyManagerBase	Policy	Persisting policy 
2017-08-11 09:30:14.2266	INFO	CyveraService	19	Cyvera.Client.Service.Policy.PolicyManagerBase	Policy	Updating policy version to 349 
2017-08-11 09:30:14.2266	DEBUG	CyveraService	19	Cyvera.Client.Service.Policy.PolicyManagerBase	Policy	Notifying system of policy change 
2017-08-11 09:30:14.2266	DEBUG	CyveraService	19	Cyvera.Client.Service.Policy.PolicyManagerBase	Policy	Updating policy in registry. 
2017-08-11 09:30:14.2266	INFO	CyveraService	19	Cyvera.Client.Service.Policy.PolicyRegistryWriter	Policy	Try to delete policy tree - OnPolicyUpdating 
2017-08-11 09:30:14.2266	INFO	CyveraService	19	Cyvera.Client.Service.Policy.PolicyRegistryWriter	Policy	Call WritePolicyToRegistry 
2017-08-11 09:30:14.2266	INFO	CyveraService	19	Cyvera.Client.Service.Policy.PolicyRegistryWriter	Policy	Call WriteOptInsToRegistry 
2017-08-11 09:30:14.2266	INFO	CyveraService	19	Cyvera.Client.Service.Policy.PolicyRegistryWriter	Policy	tryParse defaultDisableInjection 
2017-08-11 09:30:14.2967	INFO	CyveraService	35	Cyvera.Client.Service.OneTimeActions.Actions.InstallUpdateAction	Action	Downloaded file successfully. 
2017-08-11 09:30:14.4022	ERROR	CyveraService	35	Cyvera.Client.Service.OneTimeActions.Actions.InstallUpdateAction	Action	Signature validation failed for 'C:\ProgramData\Cyvera\Everyone\Temp\Update_10874\dff2fe1a-dab9-4d3c-ad36-43488ee7486a' package. 
2017-08-11 09:30:14.4022	INFO	CyveraService	35	Cyvera.Client.Service.OneTimeActions.OneTimeActionBase	Action	Action of type InstallUpdate with id 10874 finished execution with result 'False' 
2017-08-11 09:30:14.4022	DEBUG	CyveraService	35	Cyvera.Client.Service.OneTimeActions.ActionManager	Action	Saving action storage to C:\ProgramData\Cyvera\LocalSystem\Actions.xml 
2017-08-11 09:30:14.4022	INFO	CyveraService	19	Cyvera.Client.Service.Policy.PolicyRegistryWriter	Policy	Call ValidateRopEntries 
2017-08-11 09:30:14.4022	INFO	CyveraService	19	Cyvera.Client.Service.Policy.PolicyRegistryWriter	Policy	Call WriteGeneratSettingsToRegistry 
2017-08-11 09:30:14.4022	INFO	CyveraService	19	Cyvera.Client.Service.Policy.PolicyRegistryWriter	Policy	Call WriteSprotToRegistry 
2017-08-11 09:30:14.4092	INFO	CyveraService	35	Cyvera.Client.Service.OneTimeActions.OneTimeActionBase	Action	Failed executing one time Action InstallUpdate 
2017-08-11 09:30:14.4258	INFO	CyveraService	12	Cyvera.Client.Service.CyveraService	General	Start EnableStop 
2017-08-11 09:30:14.4258	INFO	CyveraService	12	Cyvera.Client.Service.CyveraService	General	Setting 'enable service stop' to True 
2017-08-11 09:30:14.4258	DEBUG	CyveraService	12	Cyvera.Client.Service.CyveraService	General	Received ControlsAccepted=197 
2017-08-11 09:30:14.4258	INFO	CyveraService	19	Cyvera.Client.Service.Policy.PolicyRegistryWriter	Policy	Try to delete policy tree, after CuApplyPolicy 
2017-08-11 09:30:14.4613	DEBUG	CyveraService	19	Cyvera.Client.Service.Policy.PolicyManagerBase	Policy	Finished updating policy in registry. 
2017-08-11 09:30:14.4613	INFO	CyveraService	19	Cyvera.Client.Service.Policy.PolicyManagerBase	Policy	Update policy from server completed. 
2017-08-11 09:30:14.4613	DEBUG	CyveraService	29	Cyvera.Client.Service.Policy.PolicyManagerBase	Policy	PolicyUpdated thread started 
2017-08-11 09:30:14.4613	DEBUG	CyveraService	19	Cyvera.Client.Service.Policy.PolicyManagerBase	Policy	Update from server completed 
2017-08-11 09:30:14.4613	DEBUG	CyveraService	19	Cyvera.Client.Service.Heartbeat.HeartbeatManager	Heartbeat	Trying to start heartbeat. Send heartbeat = True, Server address was found = True 
2017-08-11 09:30:14.4613	DEBUG	CyveraService	19	Cyvera.Client.Service.OneTimeActions.ActionManager	Action	Saving action storage to C:\ProgramData\Cyvera\LocalSystem\Actions.xml 
2017-08-11 09:30:14.4613	INFO	CyveraService	19	Cyvera.Client.Service.Policy.PolicyManagerBase	Policy	Updating policy from server, force=True 
2017-08-11 09:30:14.4613	DEBUG	CyveraService	19	Cyvera.Common.Interfaces.LicensingNew.LicenseEncryptor	General	About to decrypt license for machine 'FMHEPC-TGU017': 'fmhepc-tgu017' 
2017-08-11 09:30:14.4713	DEBUG	CyveraService	19	Cyvera.Common.General.Win32.SessionHelper	General	Found active session with user: fmhetgu 
2017-08-11 09:30:14.5944	DEBUG	CyveraService	19	Cyvera.Client.Service.Policy.PolicyManagerBase	Heartbeat	Sending heartbeat to server 
2017-08-11 09:30:14.6069	DEBUG	CyveraService	19	Cyvera.Client.Service.Policy.PolicyManagerBase	Heartbeat	Heartbeat completed successfully, continuing update from server 
2017-08-11 09:30:14.6069	INFO	CyveraService	19	Cyvera.Client.Service.Heartbeat.ServerAddressesManager	Communication	"Received 4 possible server addresses: 
Tags (3)
L2 Linker

Re: Upgrade agents 3.3.3 -> 3.4.4 -> 4.0.2 with action rule failing

 ==========

2017-08-11 09:30:14.4022 ERROR CyveraService 35 Cyvera.Client.Service.OneTimeActions.Actions.InstallUpdateAction Action Signature validation failed for 'C:\ProgramData\Cyvera\Everyone\Temp\Update_10874\dff2fe1a-dab9-4d3c-ad36-43488ee7486a' package.

==========

Please check the OS of the target agents.

 

Due to a support issue with the (sha2) certificates packaged with the installer, you cannot upgrade the Traps agent on Windows XP, Windows Vista, Windows Server 2003, or Windows Server 2008 using an action rule on the ESM Console. Instead, you must use an alternate deployment method, such as SCCM or GPO, to deploy the agent to those endpoints.

 

https://www.paloaltonetworks.com/documentation/34/endpoint/newfeaturesguide/upgradedowngrade-conside...

 

L0 Member

Re: Upgrade agents 3.3.3 -> 3.4.4 -> 4.0.2 with action rule failing

Hi again.

 

Thanks for the tips. The os version is 10.0.15063 N/A Build 15063. So thats not the fix.

L2 Linker

Re: Upgrade agents 3.3.3 -> 3.4.4 -> 4.0.2 with action rule failing

Try this..

 

The issue has been resolved and it was down to the Action rule was not be seen as new, I stopped the services and removed action.json, located in C:\ProgramData\Cyvera\LocalSystem\Data  this allowed one endpoint to update. 

 

Following discussion with PA support they suggested this query needed to be run on the SQL DB on the ESM. (BACKUP DB FIRST)

 

DBCC CHECKIDENT('OneTimeAction',RESEED,4000) 

 

(back up sql first)

 

the re-create the action and endpoints start updating.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!