Client Management Suite

Hello,

We are facing an issue where a software update task is running every 15 minutes on many machines but we are unable to find any details about the task/  policy. Checked the vItem table and there is no information about the policy with GUID {A1939DC8-DA4A-4E46-9629-0500C2383ECA} . It appears to be initiated by the SoftwareUpdateAgent. We do not use Altiris patching and Windows System Assessment Scan is the only ploicy related to patching which runs at 1200 Hrs daily.

Log content similar to the one mentioned below is generated every 15 minutes.

Could you please help us in identifying this task and taking necessary steps to stop it if it is not normal? Please let me know if you need more information. Thanks in advance.

*********************************************************************
<event date='Apr 03 07:30:00' severity='4' hostName='CLIENT1' source='ScheduleEngine' module='AgentScheduler.dll' process='AeXNSAgent.exe' pid='4484' thread='1048' tickCount='1106486059' >
  <![CDATA[Schedule Software Update Application Task ({A1939DC8-DA4A-4E46-9629-0500C2383ECA}) triggered at 2014-04-03 07:30:00 -4:00]]>
</event>
<event date='Apr 03 07:30:00' severity='4' hostName='CLIENT1' source='SimpleThread' module='AgentScheduler.dll' process='AeXNSAgent.exe' pid='4484' thread='3968' tickCount='1106486059' >
  <![CDATA[AgentScheduler: Thread #1233 thread 0xF80 beginning]]>
</event>
<event date='Apr 03 07:30:00' severity='4' hostName='CLIENT1' source='ScheduleEngine' module='AgentScheduler.dll' process='AeXNSAgent.exe' pid='4484' thread='1048' tickCount='1106486059' >
  <![CDATA[Next event expected at 2014-04-03 07:45:00 -4:00, wakeup in 14 minutes and 59 seconds]]>
</event>
<event date='Apr 03 07:30:00' severity='4' hostName='CLIENT1' source='SoftwareUpdateAgent' module='PatchMgmtAgents.dll' process='AeXNSAgent.exe' pid='4484' thread='3968' tickCount='1106486059' >
  <![CDATA[OnScheduleDue fired: {A1939DC8-DA4A-4E46-9629-0500C2383ECA} - Software Update Application Task ]]>
</event>
<event date='Apr 03 07:30:00' severity='4' hostName='CLIENT1' source='MaintenanceWindowMgr' module='PatchMgmtAgents.dll' process='AeXNSAgent.exe' pid='4484' thread='1564' tickCount='1106486059' >
  <![CDATA[isAbidingByMaintenanceWindows() - yes]]>
</event>
<event date='Apr 03 07:30:00' severity='4' hostName='CLIENT1' source='MaintenanceWindowMgr' module='PatchMgmtAgents.dll' process='AeXNSAgent.exe' pid='4484' thread='1564' tickCount='1106486059' >
  <![CDATA[okayToDoMaintenance() - 2014-04-03 07:30:00 -4:00 yes]]>
</event>
<event date='Apr 03 07:30:00' severity='4' hostName='CLIENT1' source='SoftwareUpdateAgent' module='PatchMgmtAgents.dll' process='AeXNSAgent.exe' pid='4484' thread='1564' tickCount='1106486059' >
  <![CDATA[stateChangeEvent() It is time to apply updates ]]>
</event>
<event date='Apr 03 07:30:00' severity='4' hostName='CLIENT1' source='SoftwareUpdateAgent' module='PatchMgmtAgents.dll' process='AeXNSAgent.exe' pid='4484' thread='1564' tickCount='1106486059' >
  <![CDATA[Changing state from [Ready] to [Checking updates]]]>
</event>
<event date='Apr 03 07:30:00' severity='4' hostName='CLIENT1' source='SoftwareUpdateAgent' module='PatchMgmtAgents.dll' process='AeXNSAgent.exe' pid='4484' thread='1564' tickCount='1106486059' >
  <![CDATA[stateChangeEvent() No software updates require installation ]]>
</event>
<event date='Apr 03 07:30:00' severity='4' hostName='CLIENT1' source='SoftwareUpdateAgent' module='PatchMgmtAgents.dll' process='AeXNSAgent.exe' pid='4484' thread='1564' tickCount='1106486059' >
  <![CDATA[Changing state from [Checking updates] to [Ready]]]>
</event>
<event date='Apr 03 07:30:00' severity='4' hostName='CLIENT1' source='MaintenanceWindowMgr' module='PatchMgmtAgents.dll' process='AeXNSAgent.exe' pid='4484' thread='1564' tickCount='1106486059' >
  <![CDATA[isAbidingByMaintenanceWindows() - yes]]>
</event>
<event date='Apr 03 07:30:00' severity='4' hostName='CLIENT1' source='MaintenanceWindowMgr' module='PatchMgmtAgents.dll' process='AeXNSAgent.exe' pid='4484' thread='1564' tickCount='1106486059' >
  <![CDATA[okayToDoMaintenance() - 2014-04-03 07:30:00 -4:00 yes]]>
</event>
<event date='Apr 03 07:35:00' severity='4' hostName='CLIENT1' source='SimpleThread' module='AgentScheduler.dll' process='AeXNSAgent.exe' pid='4484' thread='3968' tickCount='1106786065' >
  <![CDATA[AgentScheduler: Thread #1233 thread 0xF80 ending, exit code=0]]>
</event>
<event date='Apr 03 07:35:00' severity='4' hostName='CLIENT1' source='MaintenanceWindowMgr' module='PatchMgmtAgents.dll' process='AeXNSAgent.exe' pid='4484' thread='1564' tickCount='1106786080' >
  <![CDATA[isAbidingByMaintenanceWindows() - yes]]>
</event>
<event date='Apr 03 07:35:00' severity='4' hostName='CLIENT1' source='MaintenanceWindowMgr' module='PatchMgmtAgents.dll' process='AeXNSAgent.exe' pid='4484' thread='1564' tickCount='1106786080' >
  <![CDATA[okayToDoMaintenance() - 2014-04-03 07:35:00 -4:00 yes]]>
</event>
<event date='Apr 03 07:40:00' severity='4' hostName='CLIENT1' source='MaintenanceWindowMgr' module='PatchMgmtAgents.dll' process='AeXNSAgent.exe' pid='4484' thread='1564' tickCount='1107086086' >
  <![CDATA[isAbidingByMaintenanceWindows() - yes]]>
</event>
<event date='Apr 03 07:40:00' severity='4' hostName='CLIENT1' source='MaintenanceWindowMgr' module='PatchMgmtAgents.dll' process='AeXNSAgent.exe' pid='4484' thread='1564' tickCount='1107086086' >
  <![CDATA[okayToDoMaintenance() - 2014-04-03 07:40:00 -4:00 yes]]>

************************************************************************************************

Check "Default Software Update Plug-in Policy" settings

Open SMP Console ⇒ "Settings" ⇒ "All Settings" ⇒ expand "Software" ⇒ expan "Patch Management" ⇒ expand "Windows" ⇒ check "Default Software Update Plug-in Policy"

Probably there is set a "Schedule Window"

Hello Igor,

I found the "Default Software Update Plug-in Policy" setting under

SMP Console ⇒ "Agents/ Plug-ins" ⇒ "All Settings" ⇒ expand "Software" ⇒ expand "Patch Management" ⇒ expand "Windows" ⇒ check "Default Software Update Plug-in Policy".

This is scheduled to run every 15 minutes throughout the day. I will test by disabling this policy and see if this makes any difference.

Thank you very much for your help.

Hi Raj Dey,

I see that by default this policy is scheduled to run "Daily" at 03:00, so in your case, someone has set it to run daily after each 15 minutes.

Also you can check when this policy was modified:

• Mouse right-click menu on this "Default Software Update Plug-in Policy" ⇒ click "Properties" and check "Audit" tab.

Thanks,

IP.

Hello Igor,

Thanks for your help.

I disabled the "Default Software Update Plug-in Policy" yesterday but I see that the Software Update task using the PatchMgmtAgents.dll module still runs every 15 minutes. This task is triggered by the policy with GUID {A1939DC8-DA4A-4E46-9629-0500C2383ECA} but I am unable to find information about this policy. I have checked the Items table in the Symantec_CMDB database, but could not find any reference for this guid.

Could you please help in identifying this policy so that I can address this?

**************************************************************************************

 <![CDATA[Schedule Software Update Application Task ({A1939DC8-DA4A-4E46-9629-0500C2383ECA}) triggered at 2014-04-08 11:45:00 -4:00]]>
</event>
<event date='Apr 08 11:45:00' severity='4' hostName='CLIENT1' source='ScheduleEngine' module='AgentScheduler.dll' process='AeXNSAgent.exe' pid='4484' thread='1048' tickCount='1553781096' >
  <![CDATA[Next event expected at 2014-04-08 12:00:00 -4:00, wakeup in 14 minutes and 59 seconds]]>
</event>
<event date='Apr 08 11:45:00' severity='4' hostName='CLIENT1' source='SimpleThread' module='AgentScheduler.dll' process='AeXNSAgent.exe' pid='4484' thread='2820' tickCount='1553781096' >
  <![CDATA[AgentScheduler: Thread #1733 thread 0xB04 beginning]]>
</event>
<event date='Apr 08 11:45:00' severity='4' hostName='CLIENT1' source='SoftwareUpdateAgent' module='PatchMgmtAgents.dll' process='AeXNSAgent.exe' pid='4484' thread='2820' tickCount='1553781112' >
  <![CDATA[OnScheduleDue fired: {A1939DC8-DA4A-4E46-9629-0500C2383ECA} - Software Update Application Task ]]>
</event>
<event date='Apr 08 11:45:00' severity='4' hostName='CLIENT1' source='MaintenanceWindowMgr' module='PatchMgmtAgents.dll' process='AeXNSAgent.exe' pid='4484' thread='1564' tickCount='1553781112' >
  <![CDATA[isAbidingByMaintenanceWindows() - yes]]>
</event>
<event date='Apr 08 11:45:00' severity='4' hostName='CLIENT1' source='MaintenanceWindowMgr' module='PatchMgmtAgents.dll' process='AeXNSAgent.exe' pid='4484' thread='1564' tickCount='1553781112' >
  <![CDATA[okayToDoMaintenance() - 2014-04-08 11:45:00 -4:00 yes]]>
</event>
<event date='Apr 08 11:45:00' severity='4' hostName='CLIENT1' source='SoftwareUpdateAgent' module='PatchMgmtAgents.dll' process='AeXNSAgent.exe' pid='4484' thread='1564' tickCount='1553781112' >
  <![CDATA[stateChangeEvent() It is time to apply updates ]]>
</event>
<event date='Apr 08 11:45:00' severity='4' hostName='CLIENT1' source='SoftwareUpdateAgent' module='PatchMgmtAgents.dll' process='AeXNSAgent.exe' pid='4484' thread='1564' tickCount='1553781112' >
  <![CDATA[Ignoring update schedule - updates cannot be applied whilst in this state]]>
</event>
<event date='Apr 08 11:46:00' severity='4' hostName='CLIENT1' source='MaintenanceWindowMgr' module='PatchMgmtAgents.dll' process='AeXNSAgent.exe' pid='4484' thread='1564' tickCount='1553841125' >
  <![CDATA[isAbidingByMaintenanceWindows() - yes]]>
</event>
<event date='Apr 08 11:46:00' severity='4' hostName='CLIENT1' source='MaintenanceWindowMgr' module='PatchMgmtAgents.dll' process='AeXNSAgent.exe' pid='4484' thread='1564' tickCount='1553841125' >
  <![CDATA[okayToDoMaintenance() - 2014-04-08 11:46:00 -4:00 yes]]>

***************************************

According to these settings, if computer is in "Maintenance Window", then by default it should check every "30 minutes". Please take a look on these settings:

Hi Igor,

The patch remediation settings was indeed set to run every 15 minutes. I have made changes in the schedule and will be monitoring the change.

Thanks for your help.

Hi Igor,

I have changed the changed the schedule for the "Software Update Plugin Install" and "Windows Patch Remediation settings" by following the above two steps. The software update scan does not run every 15 minutes now.

Thanks for your help.

Hi Raj Dey!

I'm glad that your problem is resolved.