Client Management Suite

Good Day,

Environment:  2008R2 Standard

CMS 7.5

1 Notification Server

2 CEM Gateway servers

2 Site Servers

4500 users - All connect via CEM only, no network connection to any of these clients

We have an issue in our field where some of our agents stop connecting to the Notification Server.  When we first set the users up with Altiris, the agent connected and performed without any issues.  The inventory jobs ran and all seemed to work fine.  Within a week or 2, some agents stop connecting to the NS for an unknown reason and no longer report to Altiris.  We purge the server for those who do not connect within 30 days.  This way we can keep the field current and recoup our licenses.  

I was able to remote onto a system and found that when i tried to open the Altiris agent using Aexagentactivate.exe, i get an error from the client.  I have tried restarting the computer, restarting the services and found that the only way to fix this was to uninstall and install the agent again.  After this happens the agent connects just fine.  sorry i dont have a screenshot of the error.  

A couple questions i have:

1.  Is there a way to collect agent logs from managed computers who have this issue?

2.  I have a different system that i can use to execute commands or batch files of the managed computers, is there a repair command line i can send to attempt to fix this issue?

Any help or insight here is appreciated.  Thanks

Jon

You can look at Agent logs by using the Remote Altiris Agent Diagnostics (RAAD) tool:

http://www.symantec.com/docs/HOWTO21449

Or just copy them from the remote machine to yours.

Hi!

First is required to collect all logs from problematic client computer:

• C:\ProgramData\Symantec\Symantec Agent\Logs\

After client logs analyzing, you can determine, whether is required to check logs from SMP server and from CEM gateway as well.

Good that you've found how to resolve this problem, but better to investigate logs from client and server side and try to find a root cause of this issue to avoid such workaround to use each time, when issue appears.

Questions:

1. Your environment is in hierarchy or there is only a single SMP server, which manages all your endpoints?
2. Did you check a "Blacklisted host computers" filter on SMP Server to determine, does this problematic appear there?
3. You're using a default purging settings/schedule on SMP Server or something another settings/schedule?

Thanks,

IP.

I dont beleive i can use the RAAD tool because all my clients connect over CEM so i have no direct access to the machines.  I will try to get the log files from a problematic computer.

IP,

1.  Not a hierarchy system, 1 smp with 2 site servers

2.  no computers blacklisted nothing in the filter.

3.  I scheudled a purge for every 30 days.  In our field a user has to connect to one of our application servers every 7 days in order to do business.  So we assume that if you havent connected in 30 days, chances are your not going to connect any time soon so we purge.  

I know i am lacking in details here but wanted to see if anyone had run into this scenario before.  

I assume that:

1. If CEM clients were installed via "CEM Offline" package, then what date range is set for certificate expiration there? Probably certificate becomes expired, therefore client unable to establish connection via CEM Gateway and becomes inactive and then gets purged, according to rule on SMP Server.

You can check Certificates reports on SMP Console:

• SMP Console -> "Reports" -> expand "Notification Server Management" folder -> expand "Certificates" folder.

2. Well, if CEM client becomes purged but it still has connection to SMP Server, then it should re-register once again. According to your results, this client becomes unavailable and seems like because connection stucks somewhere and doesn't arrive through a CEM Gateway.

Client/CEM Gateway/SMP Server logs should explain this issue.

Thanks,

IP.

It is not a certificate error i set the expiration date to 2022 and i use the same install package for all users.  This is not a connection issue.  The Agent on the PC, literally will not open.  The agent never tries to connect.