LMS 3.2 Compliance jobs and crypto trustpoints

Hi Guys,
Got a little bit of a problem. I am trying to write a compliance job that is going to adjust the config in a trustpoint. I need it to first confirm that the trustpoint exists and then add some additonal command to the trust point.
crypto pki trustpoint fred
enrollment mode ra
enrollment xxxx
So from the above config I would write a job that would have a pre-requisite of crypto pki trustpoint fred
and then add auto-enroll x regenerate into the trustpoint.
However when I try to do this via compliance job the job always shows as compliant even though the device has not got the auto-enroll x regenerate line in the trustpoint.
It doesn't seem to matter whether I do a basic or advanced compliance job, or whether I set the pre-requite of crypto pki trustpoint fred as both a pre-requisite and parent of the subcommand auto-enroll x regenerate or just a pre-requisite. It also doesn't seem to matter whether I set the auto-enroll x regenerate command as a subcommand or global. All attempts seem to pass as compliant even though they only have the pre-requisite met and not the command I am looking for within the pre-requisite as a sub command?
Any ideas as I need to deploy this configuration across about 100 devices tomorrow
Thanks

Just to let people know, I raised a bug with Cisco TAC and they have told me to install SP1. Apparently this fixes a lot of compliance type issues. Will report back once its done to confirm if the problem is fixed.

Similar Messages

LMS 4.2.2 - Compliance Policy and PSIRT/EOX Job Report

I noticed that the job titled Compliance Policy and PSIRT/EOX Job Report has been running since oct 4, 2012 @ 00:30:00. I can see that previous jobs usually take about 3 minutes to complete. Is there a way to stop the job? Is it safe to stop the job? TIA

Hi,
you seems to be hitting the below BUg
LMS4.2.1: System Psirt Job failing
CSCua64861
Applicable to 4.2 as well.
Thanks-
Afroz
****Ratings Encourages Contributors****

LMS 4.2.3 baseline compliance template and standard ACL

When using a baseline compliance template to check and deploy a standard ACL, I encountered what seems to be a bug:
I configured a template with these commands:
+ip access-list standard 21
+; Hosts allowed access
+ permit host 10.20.30.40
+ permit host 40.30.20.10
+ deny any log
When I do compliance check and deployment, the last line is dropped by LMS.
In fact, when I look into the job's "Work Order", the commands are:
ip access-list standard 21
; Hosts allowed access
permit host 10.20.30.40
permit host 40.30.20.10
After the job run, "show running-config" shows the access list matching the "Work Order" (without the "deny any log" command.)
Is this a bug?

Doesnt have any issues on my Lab 4.2.4. following is the Job Work order :
Name:
Archive Mgmt Job Work Order
Summary:
General Info
JobId: 2704
Owner: admin
Description: test_acl
Schedule Type: Immediate
Job Type: Compliance Check
Baseline Template Name: test_acl
Attachment Option: Disabled
Report Type: NAJob Policies
----------------------------------------------------------------------------------------------E-mail Notification: Not Applicable
Job Based Password: DisabledDevice Details
Device
Commands
Sup_2T_6500
ip access-list standard 21
permit host 10.20.30.40
permit host 40.30.20.10
deny any log
10.104.149.180
ip access-list standard 21
permit host 10.20.30.40
permit host 40.30.20.10
deny any log
Check your template, or export it and share, i will try it on my LMS server. also, check the same complaince job on other devices if you have such issues.
-Thanks
Vinod
**Rating Encourages contributors, and its really free. **

CiscoWorks: Compliance job to find NTP status in switches?

Hi,
We have about 4000 switches in our estate, and we want to find from CiscoWorks that which devices are not configured with correct NTP source. Is it possible to run a compliance job in CiscoWorks to findout that which switches "clock is unsynchronized". e.g. if we do "show ntp status" on switch, we get output as "clock is unsynchronized". How we can run this job in compliance jobs.
Or please advise a better way to find this issue.
We are using LMS 3.2 SP1
Thanks and Kind Regards,

I would run a job that puts the username password on all of them. And runs a no username johndoe for all username you know of, that you want to remove
So it may overwrite the same username password..... I don't mind, it will be done when I get back in the morning.
Cheers,
Michel

CiscoWorks: Compliance job to change usernames/password in devices.

Hi,
We have configured devices with TACACS and in case TACACS don’t work then fall back to local credentials..We have different passwords on different devices. Is it possible in compliance job that if particular username/password match, then change it to different username/password.
e.g. if username=abc and password=123 then change it to username=def and password=456
or if
if username=abc and password=cisco then change it to username=ciscoworks and password=ciscoworks123
We want to run this job on 3500 devices via CiscoWorks. Please advise.
Thanks. We are using LMS 3.2.1.

I would run a job that puts the username password on all of them. And runs a no username johndoe for all username you know of, that you want to remove
So it may overwrite the same username password..... I don't mind, it will be done when I get back in the morning.
Cheers,
Michel

LMS 4.2.3 discrepancies and deviations change when not on the network

I am performing an assessment using LMS 4.2.3 and collected all of the inventory and configurations successfully. I am running LMS on an engineering laptop and to ease my remote access, I moved it from the customer site to one of our offices. I had already captured the summary of the best practice deviations and discrepancies and now several days later I am trying to get the details but most of the original data is missing, including what was in the summary tables. Do I have to be actively polling the managed devices for these tables to maintain their information or is there a way for LMS to recalculate these from the saved configurations?

Which compliance report are you trying to run? I think almost all should be applicable to a 3750G switch. I know I've run against various 3k models just fine (though don't have a 3750G in my lab to check).
I'd look in Device Center and verify that you have an inventory and configuration file gathered for that device.

Cisco Works LMS 4.x NetShow Jobs URL

Hi
I have upgraded our LMS 3.x to the new LMS 4.x Version.
I have installed the new 4.x on an new server and importet the backup.
I have importet a Certificate and have enabled the Browser-Server Security Mode: Enabled
I added some new Netshow Jobs which run every day.
I get the email from the jobs and the URL in the email but:
http://servername:1741/rme/NSViewJobResults.do?jobId=5528.5
When i click on the link i only get:
Forbidden
You don't have permission to access /rme/NSViewJobResults.do on this server.
Additionally, a 403 Forbidden error was encountered while trying to use an ErrorDocument to handle the request.
i must change the link to
https://servername/rme/NSViewJobResults.do?jobId=5528.5
Than it works.
Is there anywhere an option to edit the text which is send with the jobs, to fix the url?
Kind regards, Feichti

Hi,
Since you have enabled the option of Browser Server security mode : Enabled, try the access the URL with the https with the port 443 like below :-
https://servername:443/rme/NSViewJobResults.do?jobId=5528.5
And see if this works.
Thanks,
Gaganjeet

Triggering Process chain based on execution of R3 job and Process Chain

Hi All,
I need your help in arriving at a solution for a reqirement.
Scenario is., I need to trigger a process chain B based on successful execution of Process chain A and an R3 job. If both conditions(Completion of R3 job and Process Chain A) are met then only it has to trigger process Chain B.
I know that we can use events to trigger a process chain using R3 job.But my case is differenet I need to consider the success message from both process chain and R3 job.Is there any way to solve it ?
Please provide me with your valuable inputs.
Thanks,
Bindu

Hi Hima,
You can use the 'AND' variant for both, If both are success then trigger the process chain.
Regards,
Ravi Kanth
Edited by: Ravi kanth on Apr 30, 2009 3:36 PM

I need to use Outlook Express to apply for jobs and I either don't have it but when I try to send an e-mail on Outlook Express, it won't go through and gives me an error report.....I really need to be able to use Outlook Express to apply for jobs. Help!

When I try to apply for job and when I try to e-mail my resume' and Outlook Express comes up to reply to on, I put in my information, etc but when I hit send, it doesn't go through and says? POP and then error report and doesn't go through.

I can't provide a solution with or without the error message, but without an error message, you are making everyone guess at what you see. I have no idea what you see, and I think someone who might be able to help you solve your problem would need to know what that message says. Is "Outlook Express" (Windows Live Mail) your default email processor, if not what is?

Creating a job and scheduling a job error in OEM

Hi, Everyone,
I am trying to create and schedule a job thru OEM. In the the pl/sql block provide i have given my code like this
begin
SET SERVEROUTPUT ON;
SPOOL C:\RFV_PROFILE_REPORT.LOG APPEND;
SELECT TO_CHAR(SYSDATE, 'DD/MM/YY HH24:MI:SS') FROM DUAL;
EXEC PAC_RFV_PROFILE_REPORT.CALL_ALL (200910);
SELECT TO_CHAR(SYSDATE, 'DD/MM/YY HH24:MI:SS') FROM DUAL;
SPOOL OFF;
end;
i have created the job and scheduled it but i am getting this error:
Error # 6550
Details ORA-06550: line 2, column 5: PL/SQL: ORA-00922: missing or invalid option ORA-06550: line 2, column 1: PL/SQL: SQL Statement ignored ORA-06550: line 3, column 7: PLS-00103: Encountered the symbol "C" when expecting one of the following: := . ( @ % ;
could anyone pls help as this is very urgent.
Thanks in advance

Ah, the problem is you are confusing SQLPlus commands with PL/SQL.
SET SERVEROUTPUT ON; -- This is a SQLPlus command, not necessary here.
SPOOL C:\RFV_PROFILE_REPORT.LOG APPEND; -- This is a SQLPlus command, in PL/SQL to write out to a file you will need to call the UTL_FILE package to open a file for writing to. Except that the file you write to will appear on the database server, not your workstation, when the scheduled job runs.
SELECT TO_CHAR(SYSDATE, 'DD/MM/YY HH24:MI:SS') FROM DUAL; -- In PL/SQL you need to SELECT columns INTO variables FROM tables. But in fact I guess you want to write the time to file using UTL_FILE again. However, you don't really need to do this, since scheduler will log the start time and run duration itself.
EXEC PAC_RFV_PROFILE_REPORT.CALL_ALL (200910); -- This is the SQLPlus equivalent of the PL/SQL command:
BEGIN
PAC_RFV_PROFILE_REPORT.CALL_ALL (200910);
END;
SPOOL OFF; -- This is a SQLPlus command, not necessary here.
So to summarise, all you really need is:
BEGIN
PAC_RFV_PROFILE_REPORT.CALL_ALL (200910);
END;
And the scheduled job will log the start time and duration in the database, which you can find here:
SELECT * FROM USER_SCHEDULER_JOB_RUN_DETAILS

How can I get my old iTunes music onto my new computer without access to my old computer? I left my previous job and forgot to transfer my music. I bought iTunes match and it shows my old Mac as a device, but I cannot get the music off it.

How can I get my old iTunes music onto my new computer without access to my old computer? I left my previous job and forgot to transfer my music. I bought iTunes match and it shows my old Mac as a device, but I cannot access any of the old music. All I can find are what was on my iPhone, but that's not what I want. I need all my old music from my old Mac, which has been wiped clean by IT at my old job. BUT, I did have iCloud at that time and I thought all my music would be accessible through it. I don't understand the Cloud! And I'm thinking spending $24.99 on iTunes Match was a waste of money because I still can't access my old music.

When you are done with this issue, consider the computer back at the office may still
have access to your iTunes account, and it should be de-auhorized. You can do that
remotely, but be sure you carefully do not mess up your other computer iTunes libraries.
Good luck & happy computing!

I am doing two people's jobs and I need to use two separate log-ins on the same website. How can I keep both log-ins open at the same time. Everytime I switch tabs I have to log in again.

I am doing two people's jobs and I need to use two separate log-ins on the same website. How can I keep both log-ins open at the same time. Everytime I switch tabs I have to log in again.

Try one of these extensions for multiple cookie sessions.
Multifox: 
http://br.mozdev.org/multifox/ 
Cookie Swap extension: 
https://addons.mozilla.org/firefox/3255/ 
Cookie Pie extension: 
http://www.nektra.com/oss/firefox/extensions/cookiepie/

Run the Report as a Background job and Get the Output in Excel in Local PC

Hello Gurus,
I have one following requirement.
One should be able to run the report as a background job and it should be possible to get the report in Excel format, also when running the report in background. The excel report should have the same information and look as the current SAPreport.
Please provide some solution.
Any helpful answer get surely awarded.
Thanks a lot,
Varlanir

GUI_* WS_* Function In Background, CSV Upload
GUI_* and WS_* function modules do not work in background
When scheduling a job in the background the appropriate statement to read in your file is OPEN DATASET, and the file must be on the file system that the SAP server can see.
At anytime, a user can switch of the Personal Computers even though the job is still running in the background. Therefore GUI_* and WS_* function modules are not designed to work in that way, as they need to access your personal computer file.
To choose the correct download method to used, you can check the value of SY-BATCH in your code,
if it is 'X' use OPEN DATASET and if it is ' ' use WS_UPLOAD.
*-- Open dataset for reading
DATA:
dsn(20) VALUE '/usr/test.dat',
rec(80).
OPEN DATASET dsn FOR INPUT IN TEXT MODE.
IF sy-subrc = 0.
DO.
 READ DATASET dsn INTO rec.
 IF sy-subrc <> 0.
 EXIT.
 ELSE.
 WRITE / rec.
 ENDIF.
ENDDO.
ENDIF.
CLOSE DATASET dsn.
*-- Open dataset for writing
DATA rec(80).
OPEN DATASET dsn FOR OUTPUT IN TEXT MODE.
TRANSFER rec TO '/usr/test.dat'.
CLOSE DATASET dsn.
What is the difference when we use upload, ws_upload, gui_upload function modules?
UPLOAD, WS_UPLOAD, GUI_UPLOAD, are used in BDC concepts. ie., Batch Data Communication.
Batch Data Conversion is a concept where user can transfer the Data from non SAP to SAP R/3. So , in these various Function Modules are used.
UPLOAD--- upload a file to the presentation server (PC)
WS_UPLOAD---- Load Files from the Presentation Server to Internal ABAP Tables.
WS means Work Station.
This is used upto SAP 4.6 version.
GUI_UPLOAD------- Replaces WS_UPLOAD. Upoad file from presentation server to the app server. From 4.7 SAP version it is replaced.
How to Upload csv file to SAP?
Common File Download Upload Questions:
How you upload the data from text file to sap internal table? From my knowledge its by upload or gui_upload.
How you download the data from sap internal table to text file?
How you upload the data from xls (excel) file to sap internal table how you download the data from sap internal table to xls(excel) file.
You can upload data from presentation server to an internal table using gui_upload. Use gui_download to download from internal table to flat file.
Use fm ALSM_EXCEL_TO_INTERNAL_TABLE to upload data frm excel.
Use function module GUI_UPLOAD
The FILETYPE refer to the type of file format you need: For e.g 'WK1' - Excel format , 'ASC' - Text Format etc.
CALL FUNCTION 'GUI_UPLOAD'
EXPORTING
 FILENAME = 'C:\test.csv'
 FILETYPE = 'ASC'
TABLES
 DATA_TAB = itab
EXCEPTIONS
 FILE_OPEN_ERROR = 1
 FILE_READ_ERROR = 2
 NO_BATCH = 3
 GUI_REFUSE_FILETRANSFER = 4
 INVALID_TYPE = 5
 NO_AUTHORITY = 6
 UNKNOWN_ERROR = 7
 BAD_DATA_FORMAT = 8
 HEADER_NOT_ALLOWED = 9
 SEPARATOR_NOT_ALLOWED = 10
 HEADER_TOO_LONG = 11
 UNKNOWN_DP_ERROR = 12
 ACCESS_DENIED = 13
 DP_OUT_OF_MEMORY = 14
 DISK_FULL = 15
 DP_TIMEOUT = 16
 OTHERS = 17.

Can U set breakpoint within a batch job and look at variables?

Hello friends,
I am trying to solve a problem that occurs within a program / transaction which can only be executed in background. The transaction in question is FPCOPARA and apparently this program cannot be executed in foreground.
If I understand well, we cannot set breakpoints within a background job and as a result we cannot inspect variable etc. during job execution. So the question is how to achieve the same goal within a batch job? How did you do it? As this is a standard SAP transacrtion, no program modification can be applied.
Your help is greatly appreciated.

Hi......
After u have executed ur batch job..
go to sm37 >>select ur job using checkbox>>enter 'JDBG' in transaction box and press enter
now debugger will start ..initial it will go through system code..after after a while the debugger will reach to your code and den you can debug the remaining report....
all the best
regards
vivek

Any idea while updating job and position --I am getting the following error

Hi, I am trying to update job and position to the existing employee but getting the following error
Error report:
ORA-20001: The primary key specified is invalid
Cause: The primary key values specified are invalid and do not exist in the schema.
Action: Check the primary key values before attempting to carry out the operation again.
ORA-06512: at "APPS.HR_ASSIGNMENT_API", line 16616
ORA-06512: at line 35
Code which I am using is as below
declare
l_assignment_id number;
l_object_version_number number;
l_special_ceiling_step_id number;
LC_EFFECTIVE_END_DATE DATE;
LC_EFFECTIVE_START_DATE DATE;
LC_DATETRACK_UPDATE_MODE VARCHAR2(100);
LC_GROUP_NAME VARCHAR2(1000);
LC_CONCATENATED_SEGMENTS VARCHAR2(1000);
L_ENTRIES_CHANGED_WARNING VARCHAR2(1000);
LC_GSP_POST_PROCESS_WARNING VARCHAR2(1000):=NULL;
LC_PEOPLE_GROUP_ID NUMBER:=NULL;
LC_OBJECT_VERSION_NUMBER NUMBER:=NULL;
LC_SOFT_CODING_KEYFLEX_ID NUMBER:=NULL;
LC_SPECIAL_CEILING_STEP_ID NUMBER:=NULL;
LC_GRADE_ID NUMBER:=NULL;
LC_OTHER_MANAGER_WARNING BOOLEAN:=NULL;
LC_SPP_DELETE_WARNING BOOLEAN:=NULL;
LC_ORG_NOW_NO_MANAGER_WARNING BOOLEAN:=NULL;
LCTAX_DISTRICT_CHANGED_WARNING BOOLEAN:=NULL;
L_EMP_START_DATE DATE:=NULL;
J_LOCATION_ID NUMBER;
J_PAY_BASIS_ID NUMBER;
J_SEGMENT5 number;
J_SEGMENT3 number;
J_SEGMENT2 number;
J_GRADE_ID number;
J_PAYROLL_ID number;
begin
l_assignment_id := 214;
hr_assignment_api.update_emp_asg_criteria
P_VALIDATE => FALSE
,P_EFFECTIVE_DATE => TRUNC(sysdate)
,P_DATETRACK_UPDATE_MODE => LC_DATETRACK_UPDATE_MODE
,P_ASSIGNMENT_ID => l_assignment_id
,P_GRADE_ID => J_GRADE_ID
,P_POSITION_ID => 5062
,P_JOB_ID => 3063
,P_PAYROLL_ID => J_PAYROLL_ID
,P_LOCATION_ID => 142--J_LOCATION_ID
,P_ORGANIZATION_ID => 81
,P_PAY_BASIS_ID => J_PAY_BASIS_ID
,p_segment5 => J_SEGMENT5
,p_segment2 => J_SEGMENT2
,p_segment3 => J_SEGMENT3
,P_OBJECT_VERSION_NUMBER => LC_OBJECT_VERSION_NUMBER
,P_SPECIAL_CEILING_STEP_ID => LC_SPECIAL_CEILING_STEP_ID
,P_PEOPLE_GROUP_ID => LC_PEOPLE_GROUP_ID
,P_SOFT_CODING_KEYFLEX_ID => LC_SOFT_CODING_KEYFLEX_ID
,P_GROUP_NAME => LC_GROUP_NAME
,P_EFFECTIVE_START_DATE => LC_EFFECTIVE_START_DATE
,P_EFFECTIVE_END_DATE => LC_EFFECTIVE_END_DATE
,P_ORG_NOW_NO_MANAGER_WARNING => LC_ORG_NOW_NO_MANAGER_WARNING
,P_OTHER_MANAGER_WARNING => LC_OTHER_MANAGER_WARNING
,P_SPP_DELETE_WARNING => LC_SPP_DELETE_WARNING
,P_ENTRIES_CHANGED_WARNING => L_ENTRIES_CHANGED_WARNING
,P_TAX_DISTRICT_CHANGED_WARNING => LCTAX_DISTRICT_CHANGED_WARNING
,P_CONCATENATED_SEGMENTS => LC_CONCATENATED_SEGMENTS
,P_GSP_POST_PROCESS_WARNING => LC_GSP_POST_PROCESS_WARNING);
end;
Thanks in advance
Rajini

Please post the details of the application release, database version and OS.
What HRMS patchset you are on?
Please see if these docs help.
Getting "ORA-20001: The primary key specified is invalid" Error Using HR_ASSIGNMENT_API.UPDATE_EMP_ASG_CRITERIA API [ID 737145.1]
Hr_assignment_api.Update_emp_asg_criteria Gives Ora-20001, Ora-06512 [ID 334491.1]
Thanks,
Hussein

LMS 3.2 Compliance jobs and crypto trustpoints

Similar Messages

Maybe you are looking for