Patch Management Solution

Hi all, I’m having an issue with patch deployment. We’ve just upgraded to Symantec Management 8.0, but the same issue was occurring on 7.5. The two images below are the RAAD SWD Execution logs for a couple of Windows 7 machines that I deployed updates to. The highlighted areas show gaps of approximately one hour between installations of single patches. I know that when I use the basic Windows Update from the control panel I’ve seen it install over a hundred of these updates in around an hour.

 

This issue is consistent over a variety of machine types, the only obvious thing they have in common is Windows 7.

 

Any ideas about why there are long delays between installations of individual updates?

 

Thanks

 

 

 

The first thing to look at is are the updates taking a long time to install or is the Symantec Agent leaving large gaps between installs. Look in c:\windows\temp for the log files for the patches to find out.

Thanks, I'll take a look at the logs!

Here is an excerpt from the log of one machine. I cropped out the text between the "Start SWD task" event and the event where the particular update completes. There are events from two updates, one that requires a reboot and one that doesn't. It's not 100% consistent, but it seems like the updates requiring restart take 45-90 minutes to complete and the ones not requiring restart take 1 or 2 minutes to complete. Hopefully there is an indicator in here, but if not let me know and I'll upload the whole log.

Thanks!

 

#1 - Update requiring restart

 

<event date='05/06/2016 20:35:16.2550000 -07:00' severity='4' hostName='COMPUTER1' source='ProgramExec' module='smfagent.dll' process='AeXNSAgent.exe' pid='4848' thread='5384' tickCount='7854010' >

  <![CDATA[Starting SWD task: 'Windows6.1-KB3074543-x64.msu for Through 4-2016' command line='wusa.exe Windows6.1-KB3074543-x64.msu /quiet /norestart']]>

</event>

 

<event date='05/06/2016 20:35:25.6300000 -07:00' severity='4' hostName='COMPUTER1' source='ScheduleEngine' module='AgentScheduler.dll' process='AeXNSAgent.exe' pid='4848' thread='4480' tickCount='7863386' >

  <![CDATA[Schedule  ({1CFEC044-FFF0-40D4-A2FA-F312774116B4}) activated at 2016-05-06 20:35:25 -7:00]]>

</event>

 

<event date='05/06/2016 20:35:25.6300000 -07:00' severity='4' hostName='COMPUTER1' source='ScheduleEngine' module='AgentScheduler.dll' process='AeXNSAgent.exe' pid='4848' thread='4480' tickCount='7863386' >

  <![CDATA[Next event expected at 2016-05-06 22:00:00 -7:00, wakeup in 1 hour]]>

</event>

 

<event date='05/06/2016 20:54:01.5950000 -07:00' severity='4' hostName='COMPUTER1' source='CInventoryRuleAgentPolicyManager' module='InventoryRuleAgent.dll' process='AeXNSAgent.exe' pid='4848' thread='1592' tickCount='8979339' >

  <![CDATA[Setting wakeup time to 3600000 ms (Invalid DateTime) for policy: DefaultWakeup]]>

</event>

 

<event date='05/06/2016 20:54:01.7040000 -07:00' severity='4' hostName='COMPUTER1' source='CDeliveryPolicy::IsWakeupDue()' module='smfagent.dll' process='AeXNSAgent.exe' pid='4848' thread='3444' tickCount='8979448' >

  <![CDATA[Checked if policy {FC732FBA-028C-47E2-8301-64C527787CDF} for job index 0 is due: 0 ]]>

</event>

 

<event date='05/06/2016 20:54:01.7040000 -07:00' severity='4' hostName='COMPUTER1' source='CDeliveryPolicy::GetNextWakeup()' module='smfagent.dll' process='AeXNSAgent.exe' pid='4848' thread='3444' tickCount='8979448' >

  <![CDATA[Policy Wireless AutoSwitch XPV 1.5.6.3 English({FC732FBA-028C-47E2-8301-64C527787CDF}) has no valid future scheduled run time (other than logon or startup schedules).]]>

</event>

 

<event date='05/06/2016 20:54:01.7040000 -07:00' severity='4' hostName='COMPUTER1' source='CSMFAgentPolicyManager' module='smfagent.dll' process='AeXNSAgent.exe' pid='4848' thread='3444' tickCount='8979448' >

  <![CDATA[Setting wakeup time to 3600000 ms (Invalid DateTime) for policy: DefaultWakeup]]>

</event>

 

<event date='05/06/2016 20:54:01.7660000 -07:00' severity='4' hostName='COMPUTER1' source='ConfigServer' module='AeXNSAgent.exe' process='AeXNSAgent.exe' pid='4848' thread='488' tickCount='8979511' >

  <![CDATA[The policies have not been changed since the last request]]>

</event>

 

<event date='05/06/2016 20:54:01.7660000 -07:00' severity='4' hostName='COMPUTER1' source='ServerSettings' module='AeXNSAgent.exe' process='AeXNSAgent.exe' pid='4848' thread='488' tickCount='8979511' >

  <![CDATA[Next policy request from server SFOAPM01.law.kvn.com will be at 2016-05-06 21:54:01, in 60 minutes]]>

</event>

 

<event date='05/06/2016 21:35:25.6460000 -07:00' severity='4' hostName='COMPUTER1' source='ScheduleEngine' module='AgentScheduler.dll' process='AeXNSAgent.exe' pid='4848' thread='4480' tickCount='11463390' >

  <![CDATA[Next event expected at 2016-05-06 22:00:00 -7:00, wakeup in 24 minutes and 34 seconds]]>

</event>

 

 

<event date='05/06/2016 21:38:15.6390000 -07:00' severity='4' hostName='COMPUTER1' source='ProgramExec' module='smfagent.dll' process='AeXNSAgent.exe' pid='4848' thread='5384' tickCount='11633384' >

  <![CDATA[Program 'Windows6.1-KB3074543-x64.msu for Through 4-2016' completed. Exit code=3010. Execution context='Administrator'. RunAs='\']]>

</event>

 

==================================================================================================================================

#2 - Update not requiring restart

 

 

<event date='05/06/2016 22:43:24.0980000 -07:00' severity='4' hostName='COMPUTER1' source='ProgramExec' module='smfagent.dll' process='AeXNSAgent.exe' pid='4848' thread='5068' tickCount='15541833' >

  <![CDATA[Starting SWD task: 'onenoteloc2010-kb3054978-fullfile-x86-glb.exe for Through 4-2016' command line='"C:\Program Files\Altiris\Altiris Agent\Agents\SoftwareManagement\Software Delivery\{1F912259-C4E1-3958-7922-FCBBD465F51C}\cache\onenoteloc2010-kb3054978-fullfile-x86-glb.exe" /passive /norestart /quiet']]>

</event>

 

<event date='05/06/2016 22:43:30.0260000 -07:00' severity='4' hostName='COMPUTER1' source='ScheduleEngine' module='AgentScheduler.dll' process='AeXNSAgent.exe' pid='4848' thread='4480' tickCount='15547761' >

  <![CDATA[Schedule  ({1CFEC044-FFF0-40D4-A2FA-F312774116B4}) activated at 2016-05-06 22:43:30 -7:00]]>

</event>

 

<event date='05/06/2016 22:43:30.0260000 -07:00' severity='4' hostName='COMPUTER1' source='ScheduleEngine' module='AgentScheduler.dll' process='AeXNSAgent.exe' pid='4848' thread='4480' tickCount='15547761' >

  <![CDATA[Next event expected at 2016-05-06 23:55:00 -7:00, wakeup in 1 hour]]>

</event>

 

<event date='05/06/2016 22:43:30.0260000 -07:00' severity='4' hostName='COMPUTER1' source='ScheduleEngine' module='AgentScheduler.dll' process='AeXNSAgent.exe' pid='4848' thread='4480' tickCount='15547761' >

  <![CDATA[Next event expected at 2016-05-06 23:55:00 -7:00, wakeup in 1 hour]]>

</event>

 

<event date='05/06/2016 22:43:50.4930000 -07:00' severity='4' hostName='COMPUTER1' source='ScheduleEngine' module='AgentScheduler.dll' process='AeXNSAgent.exe' pid='4848' thread='4212' tickCount='15568228' >

  <![CDATA[A monitored event has occurred, check all schedules]]>

</event>

 

<event date='05/06/2016 22:43:50.5090000 -07:00' severity='4' hostName='COMPUTER1' source='ScheduleEngine' module='AgentScheduler.dll' process='AeXNSAgent.exe' pid='4848' thread='4212' tickCount='15568244' >

  <![CDATA[A monitored event has occurred, check all schedules]]>

</event>

 

<event date='05/06/2016 22:43:50.5870000 -07:00' severity='4' hostName='COMPUTER1' source='ScheduleEngine' module='AgentScheduler.dll' process='AeXNSAgent.exe' pid='4848' thread='4212' tickCount='15568322' >

  <![CDATA[A monitored event has occurred, check all schedules]]>

</event>

 

<event date='05/06/2016 22:43:50.5870000 -07:00' severity='4' hostName='COMPUTER1' source='ScheduleEngine' module='AgentScheduler.dll' process='AeXNSAgent.exe' pid='4848' thread='4212' tickCount='15568322' >

  <![CDATA[A monitored event has occurred, check all schedules]]>

</event>

 

<event date='05/06/2016 22:43:50.5870000 -07:00' severity='4' hostName='COMPUTER1' source='ScheduleEngine' module='AgentScheduler.dll' process='AeXNSAgent.exe' pid='4848' thread='4212' tickCount='15568322' >

  <![CDATA[A monitored event has occurred, check all schedules]]>

</event>

 

<event date='05/06/2016 22:43:50.6020000 -07:00' severity='4' hostName='COMPUTER1' source='ScheduleEngine' module='AgentScheduler.dll' process='AeXNSAgent.exe' pid='4848' thread='4212' tickCount='15568338' >

  <![CDATA[A monitored event has occurred, check all schedules]]>

</event>

 

<event date='05/06/2016 22:43:53.8940000 -07:00' severity='4' hostName='COMPUTER1' source='ProgramExec' module='smfagent.dll' process='AeXNSAgent.exe' pid='4848' thread='5068' tickCount='15571629' >

  <![CDATA[Program 'onenoteloc2010-kb3054978-fullfile-x86-glb.exe for Through 4-2016' completed. Exit code=0. Execution context='Administrator'. RunAs='\']]>

</event>

 

But is that because the updates are taking a long time to install or because the Symantec Agent is taking a long time to process between installs, you need to look at the logs the updates themselves generate in c:\windows\temp or c:\windows\WindowsUpdate.log