MartinK

Thanks, that means your appliance (VHD) comes from release 7.0.66.0, not latest 7.0.72.0 where we targeted this issue.
We have decided to resolve this issue by changing default limits for all systemd services, it can be done by commands:
sed -i "s/.*DefaultLimitNOFILE=.*/DefaultLimitNOFILE=65535 /" /etc/systemd/system.conf sed -i "s/.*DefaultLimitNOFILE=.*/DefaultLimitNOFILE=65535 /" /etc/systemd/user.conf Modification of service file (eraserver.conf) won't "survive" ESMC upgrade and file will be replaced with version bundled in installer.    

Thanks, that means your appliance (VHD) comes from release 7.0.66.0, not latest 7.0.72.0 where we targeted this issue.
We have decided to resolve this issue by changing default limits for all systemd services, it can be done by commands:
sed -i "s/.*DefaultLimitNOFILE=.*/DefaultLimitNOFILE=65535 /" /etc/systemd/system.conf sed -i "s/.*DefaultLimitNOFILE=.*/DefaultLimitNOFILE=65535 /" /etc/systemd/user.conf Modification of service file (eraserver.conf) won't "survive" ESMC upgrade and file will be replaced with version bundled in installer.    

There should be full-verbosity MSIEXEC installation log with name ra-upgrade-infrastructure.log either in AGENT's Logs directory, or in system temporary directory. It should help us to identify cause of failure of last upgrade attempt.
From symptoms you describe it is possible that AGENT's service cannot stop and thus upgrade fails - in such case, could you provide us version/type of ESET security product you are using on those clients?

In appliance, ESMC console is hosted in Apache Tomcat (official CentOS7 package), so you have to modify it's configuration. Configuration file should be located in /etc/tomcat/server.xml. Only known complication is that Apache Tomcat has some special requirements for naming certificate, especially when java keystore file is used.

Could you please check SERVER's trace.log for "Error:" entries from time that login does not works? When did this started to happen? Are you using "\" delimiter when specifying domain name in login screen or some alternative?

Unfortunately you are right. Issue has been discovered during ESMC "Early Access" but was not resolved yet. As you noted, it does not respect hierarchy of groups, only results of matching dynamic group templates.

It is a client task "Security Management Center Components Upgrade" (see documentation).

ESET Security Management Components Upgrade task is only intended to upgrade agents & other ESMC components. If you want to install a newer version of the endpoint, you need to do it via "software install task". The simplest way, if you already have ESMC V7 would be to navigate to the main dashboard, tab "ESET Applications", locate the table "outdated applications" and click on the individual entries you want to update. You can then click "update installed eset products", and that would automatically create corresponding installation tasks.

According to provided logs, ESMC server has problem to establish connection to most of ESET services. It is not able to connect to ESET repository, update server, license servers .. could you verify it is properly configured? Maybe there is problem with firewall or proxy configuration?
Also I would recommend to check AGENT's trace.log -> upgrade of infrastructure is executed by AGENT, so there should be visible also upgrade errors, but my best guess is that AGENT installed on the same machine as ESMC has the same network-related problems.

Just to clarify, but configuration of AGENT (in ESET Management Agent policy) and configuration of HTTP proxy in policy for security product (i.e. ESET Endpoint Security for Windows) are completely unrelated, and each of them configure only specific product it is targeting.
Regarding settings, both of policies (Agent vs. other products) are using the same principle: there is possibility to configure one HTTP proxy for all communication (this one is mostly called global), and there is possibility to override this setting for specific services or communication types. In case of ESET Management Agent, you can use different configuration for communication with ESET infrastructure, through internet, and different HTTP proxy (or not at all) for communication between Agent and ERA/ESMC Server.
This is hard to answer, but it definitely depends on infrastructure. For example there are customers, that has very weak connection between AGENT and ESMC Server (i.e. some kind of VPN between company branches) and installation or download through this link would be killing internal network - also it would mean that ESMC has to be transformed into high-grade HTTP server. There is also alternative to use one HTTP proxy hosted side-by-side ESMC Server which should partially resolve this issue, but it is not enforced.

Hello,
We have recently learned of an issue that may affect your ERA Appliances. It is caused by an updated MySQL ODBC driver (Linux ODBC Connector package) and will manifest upon ERA service restart.
You can identify this issue by the "Error loading data" message shown in the console, or by trace.log entries mentioning missing ODBC driver.
More details, as well as the steps necessary to fix this issue (or prevent it, if you are not affected yet), can be found at https://support.eset.com/kb6760/
Regards,
Tomas