ZCM 11.2.4 - 11.3.1FRU1 Patch Management Agent Update 1

Tried the "updated" exe files, patch management now says all of our win7 machines with Office 2007 are missing SP3 (KB2526086) which is completely wrong.
https://download.novell.com/Download...d=G072RdrX4b0~

dtemple-sgi,
It appears that in the past few days you have not received a response to your
posting. That concerns us, and has triggered this automated reply.
Has your problem been resolved? If not, you might try one of the following options:
- Visit http://www.novell.com/support and search the knowledgebase and/or check all
the other self support options and support programs available.
- You could also try posting your message again. Make sure it is posted in the
correct newsgroup. (http://forums.novell.com)
Be sure to read the forum FAQ about what to expect in the way of responses:
http://forums.novell.com/faq.php
If this is a reply to a duplicate posting, please ignore and accept our apologies
and rest assured we will issue a stern reprimand to our posting bot.
Good luck!
Your Novell Forums Team
http://forums.novell.com

Similar Messages

Problem Connecting Patch Manager to Update Server

Hi:
I'm having this error:
# smpatch analyze
Cannot connect to retrieve patchdb: Connection refused
Im newbie on Solaris.
Thanks, Irvin Irizarry

# smpatch get
patchpro.backout.directory - ""
patchpro.download.directory - /var/sadm/spool
patchpro.install.types - rebootafter:reconfigafter:standard
patchpro.patch.source - https://updateserver.sun.com/solaris/
patchpro.patchset - patchdb
patchpro.proxy.host "" ""
patchpro.proxy.passwd **** ****
patchpro.proxy.port 80 8080
patchpro.proxy.user "" ""
patchpro.sun.passwd **** ****
patchpro.sun.user bgfsolaris ""
# showrev -p | egrep '119107|121118|121453|119108|121119|121454'
# pkginfo -l SUNWupdatemgru SUNWupdatemgrr | egrep 'PKGINST|VERSION'
ERROR: information for "SUNWupdatemgru" was not found
ERROR: information for "SUNWupdatemgrr" was not found
# pkginfo -l SUNWpprou SUNWppror | egrep 'PKGINST|VERSION'
PKGINST: SUNWppror
VERSION: 5.0,REV=2004.06.10.04.44
PKGINST: SUNWpprou
VERSION: 5.0,REV=2004.06.10.04.44
# uname -a
SunOS gdb01fw1 5.8 Generic_108528-27 sun4u sparc SUNW,Sun-Fire-280R
# cat /etc/release
Solaris 8 2/02 s28s_u7wos_08a SPARC
Copyright 2002 Sun Microsystems, Inc. All Rights Reserved.
Assembled 18 December 2001

ZCM Patch Management Patch Status Inaccuracies

We currently have issues with ZCM Patch Management incorrectly reporting the status of a couple of Microsoft updates. Specifically, we have firm evidence of this for the following patches (but suspect there may be more):
Microsoft Office 2007 SP3 - Microsoft Baseline Security Analyzer shows it as required, ZCM says its already applied.
MS11-049 InfoPatch 2007 - Microsoft Baseline Security Analyzer shows it as required, ZCM says it's not applicable.
We are checking the ZCM status in both the {guid}.state file on the device (which has today's date stamp) and in ZCC - both of these places show the same, incorrect, status.
We see this issue on multiple managed devices. The zone is 10.3.3. Devices have 10.3.3 with Patch Management Agent Update 2.
This isn't a timing issue, as we have left things several days before checking the status again.
I am raising a call with our Novell reseller, but am interested to find out if anyone else is seeing similar issues.
Thanks,
Martin

metheridge,
It appears that in the past few days you have not received a response to your
posting. That concerns us, and has triggered this automated reply.
Has your problem been resolved? If not, you might try one of the following options:
- Visit http://support.novell.com and search the knowledgebase and/or check all
the other self support options and support programs available.
- You could also try posting your message again. Make sure it is posted in the
correct newsgroup. (http://forums.novell.com)
Be sure to read the forum FAQ about what to expect in the way of responses:
http://forums.novell.com/faq.php
If this is a reply to a duplicate posting, please ignore and accept our apologies
and rest assured we will issue a stern reprimand to our posting bot.
Good luck!
Your Novell Product Support Forums Team
http://forums.novell.com/

ZCM Patch Management Dashboard blank

I'm using ZCM 10.2 RC1 and am trying to test Patch Management. I have patch management working, patches have downloaded and DAU is running. One thing that is not working is the dashboard. I have flash installed but the dashboard is blank. Are there any special requirements for the dashboard? Has anyone else got it working?
BTW, I'm running ZCM under Windows Server 2003 Standard x64 SP2.
Jim Webb

Originally Posted by jwebb
I'm using ZCM 10.2 RC1 and am trying to test Patch Management. I have patch management working, patches have downloaded and DAU is running. One thing that is not working is the dashboard. I have flash installed but the dashboard is blank. Are there any special requirements for the dashboard? Has anyone else got it working?
BTW, I'm running ZCM under Windows Server 2003 Standard x64 SP2.
Jim Webb
Which browser are you running? There is a known bug affecting IE...

Eval of Patch Management in ZCM 11.2

Hi
I'm currently running an evaluation copy of ZCM 11.2, trying to get a
feel for the Zenworks Patch Management product. I have a couple of
questions/problems that I hope can be answered here.
First, there seems to be quite a lot of trouble getting patches to
cache. The process just stops in the middle of a patch and hangs until
I reboot the zcm server. I've seen references to some ftf patches that
help - is this a common problem that's helped by the ftf?
Second, the number of vendors for which patches are available seems
quite limited. Most of the commonly attacked ones are there, Microsoft,
Adobe, etc., but many more are not. Google, for example is not listed.
Some patching products have many more vendors in their database. Does
Lumension/Novell have any strategy to expand this list?
Lastly, the available patches for each vendor are often very out of
date. For Sun (should be Oracle), JRE 1.7 is available, and 1.6.31, but
not 1.6.32. 1.6.31 is a really bad version - it was a vulnerability in
it that started us looking at patch management products in the first
place! The Citrix list has the 12.0 client, but no Citrix Receiver,
which is their current client..
There's a lot of really good features in ZPM, but the problems I've
experienced so far has made me a bit wary.
Regards,
Phillip E. Thomas

Phillip,
It appears that in the past few days you have not received a response to your
posting. That concerns us, and has triggered this automated reply.
Has your problem been resolved? If not, you might try one of the following options:
- Visit http://support.novell.com and search the knowledgebase and/or check all
the other self support options and support programs available.
- You could also try posting your message again. Make sure it is posted in the
correct newsgroup. (http://forums.novell.com)
Be sure to read the forum FAQ about what to expect in the way of responses:
http://forums.novell.com/faq.php
If this is a reply to a duplicate posting, please ignore and accept our apologies
and rest assured we will issue a stern reprimand to our posting bot.
Good luck!
Your Novell Product Support Forums Team
http://forums.novell.com/

Are patches for the adobe suites included in ZCM patch managment?

I see all the acrobat reader updates, but no updates for Acrobat pro or the
other components of the creative suites.
Are these included in patch managment or do we still hve to rely on the
Adobe update system?

Originally Posted by spond
Kevin,
> So I wonder then if the ZPM in ZCM still uses
> fingerprinting for its bundles.
>
yes it does, the logic's still the same, deep-down, it's just that at
the moment, there doesn't seem to be enough of a business case to
recode the PDK for the ZCM-style architecture. For those of us still
running standalone ZPM, the PDK still works, and since the patch logic
is the same, i can use it to see what's in the ZCM patches...
Shaun Pond
thanks Shaun. Makes me feel better.
I'll submit an RMS request for the Adobe products. Given that Adobe now surpassed MS in terms of vulnerabilities I think it's a poor decision on Novell's part to NOT patch the "paid for" Adobe stuff like Acrobat Standard, Pro, etc.
Especially when Adobe 9 incorporated Flash and "Acrobat" together.

Disable Patch Management temporarily on clients?

I've just noticed now that we've got ZPM enabled it seems to get a bit overexcited and start trying to patch machines while they're still being configured during our imaging process. For example our scripts go:
Image > drivers Novell Client > ZCM Agent > pre-load Bundles > AV = finish
Seems like ZPM kicks in as soon as the Agent registers into the zone. In theory it shouldn't do anything as I have the DAU set to 30 minutes after refresh (with ZCM auto refresh disabled) but yet I still see a Novell patch manager popup slide in from the corner (then disappears as quickly as it arrived)
Is there a command that can be used to temporarily disable all ZPM activity on a client? Might also be important for us for any online exams that could fall in the overall patching window.

gshaw0,
It appears that in the past few days you have not received a response to your
posting. That concerns us, and has triggered this automated reply.
Has your problem been resolved? If not, you might try one of the following options:
- Visit http://support.novell.com and search the knowledgebase and/or check all
the other self support options and support programs available.
- You could also try posting your message again. Make sure it is posted in the
correct newsgroup. (http://forums.novell.com)
Be sure to read the forum FAQ about what to expect in the way of responses:
http://forums.novell.com/faq.php
If this is a reply to a duplicate posting, please ignore and accept our apologies
and rest assured we will issue a stern reprimand to our posting bot.
Good luck!
Your Novell Product Support Forums Team
http://forums.novell.com/

Zenworks patch management and databases

Are there any known issues of Zenworks patch management deployment and corruption of Zenworks database? What would be best practices of Patch Managment and the Zenworks database?

Originally Posted by craig_wilson
Keep the Data Retention for Dashboard data low.
(No more than 30-60 days.)
Otherwise this table can grow very large and cause issues.
I believe 11.3 will have some redesign that will reduce the overhead
with that table and perhaps allow for longer retentions.
On 8/22/2013 10:46 AM, sflegnc wrote:
>
> Are there any known issues of Zenworks patch management deployment and
> corruption of Zenworks database? What would be best practices of Patch
> Managment and the Zenworks database?
>
>
Craig Wilson - MCNE, MCSE, CCNA
Novell Knowledge Partner
Novell does not officially monitor these forums.
Suggestions/Opinions/Statements made by me are solely my own.
These thoughts may not be shared by either Novell or any rational human.
And if you have say, 4,000 devices or more, I'd suggest even setting it down to 1 day or 7 days at the max. And set it WHEN you setup ZCM, not afterwards, because the database purge/changing isn't optimized properly (at least for Oracle).
Even with 7 days for us, it takes forever to delete a workstation/device along with a slew of other things. But Novell is aware of these things, and hopefully 11.3 will address most of the speed/performance issues.

Anybody have a truly functional Patch Management Component?

Does anyone have a flawless Patch Management component? One that updates caches, distributes patches, completes a daily subscription download, and just works the way it's designed to? If so, what's your setup? ZCM and agent version, Windows, SLES, Internal DB, etc? I'm just curious if switching our configuration would help our situation. We've had issues with Patch Management for as long as we've had the product. I have two SRs in and nothing is happening. :-(
We're running the ZCM 11.2.1/SLES 11 virtual appliance. Single primary and an internal Sybase DB.

Originally Posted by jdkoerner
The forceful update is due to bad setup of the patch bundles. Usually you
can look in your application or setup event log and see the switches that
are being used by patch management. On a lot of non MS critical patches
they are wrong or the logic of the bundle ignores if you have set to no
reboot. For example a number of Lync patches don't end up with the
/norestart switch even if you set the deployment to no reboot.
Getting individual patches fixed is a real pain. I have one SR from March
that still has not got anywhere and it actually the second one for the same
problem. I stopped doing new SRs for individual patches after I got Acrobat
reader 10.1.2 and then 10.1.3 fixed so they would install correctly on 64
bit machines. Now 10.1.4 is wrong with the same problem but I am sick of
going through the hassle when nothing was learned or carried forward from
the 2 previous patches. I think problems with individual patches obviously
don't get much priority but if they don't work then what is the point of
using patch management.
I am sure most of us here could generate a list of patches that do the
forceful no warning reboot but not sure if we would have to SR each one or
could do it as a bundle. If we dumped in a number of them the may get
looked at with a little more urgency.
Jim Koerner
Server - ZCM 11.2.1 w/MU2 and Internal Database on Win2008R2x64
Client - ZCM 11.2.1 w/MU2 on Win7SP1x64 and WinXPx32
"baarsd" <[email protected]> wrote in message
news:[email protected]...
>
> I can't say we have either! We are running ZCM 11.2.1 as well (Windows
> server 2008 R2 x64) with an Oracle 11g backend database (on Windows
> server 2008 R2 x64) and have just started using ZPM - I have an SR
> (#10794524091) open because all the patches I've tried deploying have
> varying levels of failure -
>
> - tried deploying Adobe Reader 10.1.4 update as a baseline, machines
> started rebooting VERY forcefully (no chance to save anything, just
> *bang* it's rebooting)
> - Skype update failing to install (that's posted here
> http://forums.novell.com/novell-prod...h-failing.html)
> - Java updates reporting errors;
> "Action "Failed to launch C:\Program Files
> (x86)\Novell\ZENworks/zpm/Remediate.exe. Exit code: 144" of the child
> bundle "Oracle Java JRE 1.6.0_35 for Windows (Update) (All-)195861068"
> failed."
> In "Programs and Features" it appears to be installed but if I try and
> verify java ('Verify Java Version'
> (Verify Java Version)) it says it isn't
> installed
>
> So I'm not very impressed with the product at the moment
>
>
> --
> baarsd
> ------------------------------------------------------------------------
> baarsd's Profile: View Profile: baarsd - Novell Forums
> View this thread: Anybody have a truly functional Patch Management Component?
>
If you're getting slow responses on your SR's, you can post on the Product Neutral -> Talk to a technical services manager and post your SR # and they should be able to prod things along for you, hopefully.

Adobe Reader and Acrobat Pro updates for 11.0.10 being pushed out through SolarWinds Patch Manager are not being recognized as applicable.

I am trying to update our Adobe Reader and Acrobat Pro to 11.0.10 using the default MSP packages with SolarWinds Patch Manager. All of the systems keep reporting as 'NOT APPLICABLE'. All of the workstations have Reader11.0.09, with about 10% still on 11.0.08 (due to the fact that the reader 11.0.09 package only patched about 2/3 of the systems). All systems that have Acrobat Pro are 11.0.09.
In SolarWinds I am using the "Adobe Systems, Inc. Packages" node.
Adobe Systems Acrobat 11 Catalog
Adobe Systems Reader 11 Catalog
and the SW Patch Manager downloads the msp's straight from Adobe.
I have checked the msp's manually and they will update at least back to 11.0.07 in Reader, and 11.0.0 in Acrobat Pro. (I had an old stand alone system that still had Reader 11.0.07, and I did a new install of Pro and went straight to update 11.0.10)
The SolarWinds Tech said, "Okay. That content is produced by Adobe. Any questions concerning applicability logic or diagnosing why a package reports as NotApplicable when that's not expected would need to be directed to Adobe, as they are solely responsible for that content and its behavior".
I am new to SolarWinds Patch Manager, and any help or advice would be greatly appreciated.

It sounds like you are attempting to use the SCUP catalogs outside of the MS solution. I can almost guarantee you that Adobe didn't test it if it's not referenced in the ETK: 11 SCCM-SCUP — Enterprise Administration Guide
That being said there "should" be logging available in any deployment solution. Since I am not familiar with Solar-Winds particular solution I can't say if it logs errors and how verbose those logs might be. If you have logs then post the output and the forum members "might" be able to assist you.

Patch management for Office 2013 on MDT

Hello,
on current MDT 2012, Office 2013 is added as an app. MSP was created for customization and placed in Update folder (did it a while ago)
I am preparing new MDT 2013. Deployed OS will be patched with latest updates. So Windows update will not take initially any time for applying patches after deployment from WSUS.
I would like to know best practices for Updating Office 2013 on Deployment Share.
Please provide a link or instructions: where to get latest O2013 Update Packages (at least security and critical) and how to place them properly in Update folder. Can it coexist with Customization.msp?
1. What is the right thing to manage this? No SCCM in place.
2. Does somebody includes Office 2013 in the image and then use GPO for customization?
Is it a valid scenario? I see at least 2 advantages: no additional time after deployment and full patches for the moment of image creation. Than it could be updated in the moment of image update.
Does it make sense? What are disadvantages of this approach?
thanks.
--- When you hit a wrong note its the next note that makes it good or bad. --- Miles Davis

Thanks to all!
Ty, I added a lot to my knowledgebase during bombing :) you with the questions since last week :) ... Thanks for the answers...
I purchased Johan's Fundamentals V4 (found it more applicable to my current needs).
A bit in pressure this week need to push 2 models deployment quickly and correctly as possible.
So don't have time to Deep Dive.
What I achieved Driver Group approach works find for tons of drivers. Tried just on model now...
Have to solve sudden issue with WinPE that was working fine and suddenly stopped working.
For O2013...
Just to make things fast I installed O2013 in reference image.
If I understand correctly I cannot use MSP file after the installation is made. I suppose to create it and add to Updates folder of the O2013 source.
So now my option is to work with GPO. I have a configured one for O2013 APPV deployment.
It works great.
Don't remember if I can manage by GPO applications appearance in the Office. (Example want to exclude Publisher and Access from being used on client PC).
Can somebody point where is the option in GPO for selecting individual apps within the Office.
In my MDT2012 I use O2013 deployment as App and use MSP.
For Appv Office I use apps selection from APPV manager. So not sure if it is doable from Office GPO.
Thanks.
--- When you hit a wrong note its the next note that makes it good or bad. --- Miles Davis

SMC not getting suggested patch info from Update Manager in Solaris 10

Hi All,
why SMC not getting suggested patch info from Update Manager in Solaris 10??
Thank you in advance.

Hi All,
why SMC not getting suggested patch info from Update Manager in Solaris 10??
Thank you in advance.

Cisco ISE 1.2 Patch 6 -- 8 Update failed

Hi all,
I wanted to know if any bugs was registered for the cumulative patch 8 for Cisco ISE 1.2 and how to mitigate any patch failures.
Important notice : I though that this error could be an unlucky try but i've tested the update two time.
Indeed, i have three deployment : A Pre-production one, a 4 nodes distributed and a 2 nodes distributed.
The patch works fine on the pre-production one, on the 2 nodes too but fails on the 4 nodes one with a very anormal behaviour.
On the "show nodes status" in Maintenance - Patch manage, i can see that my both PAN are successfully patched and the first PSN too but when the "Patch in progress" appears on the second PSN, the "installed" status is cancelled in the first PSN and become "Patch in progress" so i've two "Patch in progress" in parallel, that is an anormal procedure not discribed by Cisco on the document "Installing a software Patch". (wich discribe a sequential update of all nodes)
The symptoms after this error are :
- Unable to process EAP-TLS authentications ! (CA are stored on the First PAN and seems to be unavailable from PSN to exchange the handshake)
- The Application server try to restart but fails indefinitly even if i try to restart the node (on both PSN)
- GUI Unavailable
- MAB Auth is working
- Endpoint and Endpoint Groups menus are missing on the GUI (I push the MAC Address through the ERS API but it is very strange)
- Logs indicates one first "Patch success" on PAN and a second "Patch failed" still on PAN :(
The task that resolves this issue is to launch the command "patch remove ise 8" on all nodes and everything come back functional.
My big interrogation is that on my two other deployment, the patch was successfull and quick to process.
Thanks for your help.

This is that i did abviously... but the two PSN stay in status "Node down", the application service won't start correctly with these ADE-OS logs entries :
2014-05-28T10:26:30.023223+00:00 XXXXXXX logger: info:[application:operation:appservercontrol.sh] Starting ISE Application Server...
2014-05-28T10:26:30.311676+00:00 XXXXXXX logger: Loading PKCS11 ...
2014-05-28T10:26:30.978432+00:00 XXXXXXX logger: SLF4J: Class path contains multiple SLF4J bindings.
2014-05-28T10:26:30.978454+00:00 XXXXXXX logger: SLF4J: Found binding in [jar:file:/opt/CSCOcpm/appsrv/apache-tomcat-6.0.36/lib/slf4j-log4j12-1.5.8.jar!/org/slf4j/im
pl/StaticLoggerBinder.class]
2014-05-28T10:26:30.978502+00:00 XXXXXXX logger: SLF4J: Found binding in [jar:file:/opt/CSCOcpm/appsrv/apache-tomcat-6.0.36/lib/com.cisco.xmp.osgi.slf4j-log4j12-1.5.
8.PATCHED.jar!/org/slf4j/impl/StaticLoggerBinder.class]
2014-05-28T10:26:30.978509+00:00 XXXXXXX logger: SLF4J: See http://www.slf4j.org/codes.html#multiple_bindings for an explanation.
2014-05-28T10:26:31.638970+00:00 XXXXXXX logger: log4j:WARN No appenders could be found for logger (com.cisco.epm.config.cache.impl.ConfigCacheImpl).
2014-05-28T10:26:31.638992+00:00 XXXXXXX logger: log4j:WARN Please initialize the log4j system properly.

Solaris 8 Patch Manager Error

Anyone have any idea what this error is or how to resolve it? I'm trying to run smpatch on a Solaris 8 Sun Blade 100 box and getting the following error:
/usr/sadm/bin/smpatch download -i 112438-01
Requested patches:
112438-01
Downloading the requested patches
Error: PatchPro failed: StateMachine.start(): State machine failed.
State.getActionResult(): No valid result.
com.sun.patchpro.util.NoResultException: State.getActionResult(): No valid result.
at com.sun.patchpro.util.State.getActionResult(State.java:405)
at com.sun.patchpro.util.StateMachine.getActionResult(StateMachine.java:490)
at com.sun.patchpro.model.PatchProModel.getPatchAccumulator(PatchProModel.java:1041)
at com.sun.patchpro.cli.SMPatchServices.downloadPatches(SMPatchServices.java:1724)
at com.sun.patchpro.cli.SMPatchServices.main(SMPatchServices.java:709)

Hi,
I've just found the following in another thread:
The workaround for the bugID 6221832 (java being in another path than the default /usr/j2se/bin/ for Patch Manager 2.0 on Solaris 8) is to edit the pprosetup and pprosvc scripts
from /usr/sbin/pprosvc :
JAVACMD=/usr/j2se/bin/java
edit pprosetup and pprosvc scripts file and set JAVACMD locale variable to newly java installed path and launch smpatch get command again
Thank you. I've editted both scripts and changed the JAVACMD variable to be ${JAVA_HOME}/bin/java and now everything is working.
Thanks.

Sun update manager with patch manager

I need to use both products since I have systems running Solaris 10, 9 and 8. Is there a way to get them to work together?
Ideally, I would like to have 1 system talk to SUN to manage the application and downloads. I would want the system to distribute the patches to all the other systems.

Yes, this is possible. We would recommend setting up Sun Update Manager on Solaris 10 as your patch proxy (with a connection to Sun). Both Update Manager on Solaris 10 and Patch Manager on Solaris 8 and 9 can then be configured as clients.

ZCM 11.2.4 - 11.3.1FRU1 Patch Management Agent Update 1

Similar Messages

Maybe you are looking for