Control Compliance Suite

I recently ran the Windows Patch Assessment Meta-Document Update on my 10.5 RMS console.  Since then out of 2000 servers being queried, most come back with errors right away.  If I revert the files in the D:\Program Files (x86)\Symantec\RMS\Control\Windows\PatchAssessment to what was there before the update they scan just fine.   The message in the scan results is this:

PFGDSMBVQE001 - Distribution Job failed to distribute jobs to SQE(PFGDSMBVQE001). Error Code: -805360850 (Query Engine: The multi job failed after exceeding maximum retries.). Affected Scope: PFGDSMBVQE001 - Query Engine: The multi job failed after exceeding maximum retries.

This is the same message for all servers.  What's funny is that it can't even scan itself in the example above.  BVQE001 is a Master Query Engine...

Like I said...put the .xml and .cab files back to the old ones and it works perfectly.

Is anyone else seeing this problem?

Hi Michael,

Please verify the following items:

1. Look in Distribution rules and confirm if any rules are configured and if no rules then ignore.
2. Ran Health & Status and check if all the Query Engines are up to date with the latest Hotfix (CHF), if not please go ahead and download the latest hotfix and run the setup.
3. Once the hotfix setup is ran, make sure that you also apply hotfix that gets created in this folder “C:\Program Files\RMS\control\Windows\QE hotfixes” with latest date on all the Query Engines in your domain.
4. If you have Reporting & Analytics installed make sure that you also download and apply the latest hotfix on it as it might conflict with RMS (Some checks might won’t work if the hotfix is mismatched with RMS)

Please let me know how it goes.

Any update on this?

I opened a Support ticked on 1/20/12,  Looks like a SQE prob for me.  I took out all my SQE's and distribution rule, and the MQE ran ok.  But with the SQE's on, get same type errors.  Further, the Application log of the SQE's give this error logged:

EVENT id: 11067
Application Warning: SQE RPC Interface : QES_AddWorkNext_NT4: A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. Context Information: Patch Asssessment Error: hfnetchk6b.cab file is not properly signed. Call->BVNTQueryJobQueue::ConstructForLSD() - exception: (Domain: IND1, User: bvadmin, Source Computer: ahwappinind088.ind1.stvincent.org 10.170.8.141)
Exception was caught.

Hoping they can fix pretty soon, takes too long with only MQE performing query.

Did you update your Credentials and Connection DB's to FIPS Compliant? check the release notes for the PCU here: ftp://ftp.symantec.com/public/english_us_canada/products/symantec_control_compliance_suite/10.5.1/Updates/Data_Collectors/ReadMe_CCS_DataCollection_PCU_2011-3.pdf

Also are you using the automated Patch Assessment Download:

Please locate the executable named PatchUpdateDownloader.exe (\..Symantec\RMS\Control\Windows\) and copy to the ..\Symantec\RMS\ folder.  Utilize Task Scheduler to launch that executable at the frequency you desire.  That’s it.  You can also execute PatchUpdateDownloader.exe at a command prompt to verify that hfnetchk6b.cab is downloaded and extracted to ..\Symantec\RMS\Control\Windows\PatchAssessment\.

any luck?