Jump to content

Difficulty Upgrading Endpoints with ERA


jdashn
 Share

Recommended Posts

I've got ERA 6.5 updated, and have updated the clients to the 6.5 Agent, but now i'm having a lot of difficulty in upgrading from EAV 6.4.2016 to 6.5.2094. Each time I attempt an install from ERA i get the following error:

SoftwareInstallation: Installation failed with: (0x643), Fatal error during installation (0x643), , see software-install.log for more information located at: C:\ProgramData\ESET\RemoteAdministrator\Agent\EraAgentApplicationData\Logs\

The logs do not appear to provide much information as to why the install failed; i can provide upon request. 

I am able to deploy 6.4, and able to deploy 6.4 over 5.X  and able to deploy 6.5 to machines that do not have AV installed.. so i'm not understanding why there is so much difficulty installing 6.5 over 6.4

Is there something i'm missing? A file I can send over that will assist you in letting me know what needs to be done?  

Jdashn

 

Link to comment
Share on other sites

  • ESET Staff

Please send mi PM with mentioned installation log software-install.log. It should contain full msiexec installation log for further analysis.

Link to comment
Share on other sites

After some further testing

It seems that the uninstall portion of the 6.5 install does not work properly. If i  attempt uninstall 6.4.2016 using the 'uninstall' button, or an uninstall software task the task fails. If I attempt to Install 6.5 over 6.4.2016 eset uninstalls the previous version, but fails at the install (leaving me with a system that has no AV installed). After either of these methods i am unable to install 6.5, and get the previously mentioned error.

I have also found that if i use a previous version of the eset uninstaller tool (FileVersion 7.0.7.0) that allows the /nosafemode option (and does not uninstall the agent) and preform the uninstall a few times (first time is usually a failure) with reboots interspersed, i can uninstall 6.4, and when it's uninstalled using this method i can then install 6.5.

I have not found any of the other uninstall methods leaves the system 'clean enough' for an install of 6.5. 

I hope this helps,

 

Jdashn

Link to comment
Share on other sites

@jdashn, @MartinK - Any updates about the issue?
If ERA 6.5 has some problem installing\upgrading EAV 6.5 I might prefer to delay the upgrade until a solution is found and implemented.

 

Thanks by the way for sharing the findings, and Martin thanks for helping!

Link to comment
Share on other sites

  • ESET Staff

Hello, 

We have tried to replicate the issue, and analyze provided installation log, but without any success. We have updated dozens of environments, without issues. 

Our devs will need more information: 

  1. Could you please try manual installation directly on the client machine, if it will work? If not, please send us the install log "eea_nt32_enu.msi /lv*x install.log
  2. Please deliver "procmon, setupapi.dev.log" (C:\Windows\INF)
  3. Send us the software installation log (again, from the failed attempt).

By any chance, was your firewall driver (epfwwfpr) somehow affected / renamed / manually replaced? 

Alternatively, please create a support ticket, and also provide log collector data from the affected computer (before the upgrade). 

Link to comment
Share on other sites

@MichalJ,

I'm guessing that you can't see the ticketing system, as I have already raised a ticket (#20433) and after providing 40something mb of logs i've not been asked to provide any additional information in response yet (unless i'm not understanding something about the ticketing system and replies might come here instead of email?) 

I'm very confident that many systems have been updated without issue. I was confident the update on this end would go on without issue. This was not the case, hence my request here for assistance, then a move to a Ticket as requested by @MartinK via pm. 

Please let me know if this reply is indeed in response to the ticket i raised last week, so i can get started on collecting these additional logs for you (should i deliver them to the share file link provided to me on friday?).

@avielc Honestly all of the other updates we've done have gone smoothly, and generally the support i've gotten with eset has been stellar. I'm guessing this is just a problem isolated to my environment, though it's always best practice to test before deploy to whole org, I wouldn't let my experience here stop you from upgrading! :)

Thanks!

 

Jdashn

 

Edited by jdashn
Link to comment
Share on other sites

Thanks man, appreciate your assuring words, 

However, as you're aware, we (IT) LOVE to be 200% sure, even if everything should work as expected.
Since these are still the first days of the roll out, I'm waiting to find more info through topics that raise in the forum, (and assist where possible) to get the grasp of the full issues that I may run into. 

As you say though, it looks quite solid, only the SQL seems to be a small hiccup, (I'll move on to backups soon enough and upgrade it soon after.

Thanks again man, really appreciate it.

Aviel

Link to comment
Share on other sites

I hear you on the paranoia front! I have to say, though, once this install issue is cleared up i'm extremely excited to move onto exploring some of the new features in ERA

Have a good one, and good luck with everything when you do take the plunge. 

I will continue to update my progress here to let you know how things are going (Just finished up submitting some additional logs and waiting on a reply), at least to let folks know when / how it's been cleared up.

jdashn

Edited by jdashn
spellign erorr + clarification
Link to comment
Share on other sites

haha, no surprise, 

I do wonder though what's the cause of that.

I have this weird issue on my side as well ERA 6.4 trying to upgrade MacEAV 6.2.7 directly to 6.4.168, fails on inability to find the http package (usually means no package found in the web repo) but i am able to upgrade from 6.3.85.1 to 6.4.etc

maybe, just maybe, if I understood your issue well, trying to upgrade from a client that doesn't have a proper uninstall client\proper msi package on repo just fails to some bug in the repository, and simple 2 client tasks, one for uninstall another for fresh installation should solve it?

Link to comment
Share on other sites

That would be really nice! I've actually tried just the basic uninstall task and that fails too. It seems (from just glancing at the logs) that the uninstaller is looking for a file that isn't on my system at all. One of the things i was thinking of trying was to see if just creating a blank file at the location it's looking for would be enough to trick it into working. Though when it 'fails' it has succeeded enough in removing the previous install that it is considered 'uninstalled' for ERA , but not removed enough that the install process does not attempt to run another uninstall process (which fails, failing the install process as well).

But please take my log analysis with a grain of salt, i'm just guessing!

 

Link to comment
Share on other sites

hahah, completely understandable, 

I'm sometimes feeling the same when trying to figure the log :-)
could be that specifically the installation on that system got corrupted and will need a fresh manual installation on that system to be able and stand better for another uninstall task.

(i'm working with elimination function on these issues, trying to simulate how to solve everything step by step from all the options available, long, but QA certified ha!) 

Also, if you are using Device control policy that might require you to restart that computer to remove any left over drivers.

and one more thing, Uninstall task on ESET 6.4 could include uninstall older AV version, sometimes you might wanna try that or the all AV uninstall option there. maybe you need to try a different uninstall procedure

Fruit for thought of course, you don't have to take anything from that, and can just wait for the real support to examine and report back on the logs. :-) 

Link to comment
Share on other sites

Sorry for the delay in my reply,

There very well may be some issues with many of these machines with previous installs. Most of the machines started their ESET life with 5.X then were upgraded to 6.2, then 6.3 then 6.4.

I've tried the restarts in between and before and after, no luck, but we are using device control. 

The uninstall task in ERA is one that should uninstall 'all versions'. 

There is an uninstall procedure that i've gotten to work, it unfortunately utilizes an out-dated version of the EsetUninstaller.Bat file (7.0.7.0) that does not uninstall the Agent, and supports the /nosafemode flag... combine this a few times as a 'run a command' task,  with restart tasks interspersed and it works great.. but i can't imagine that this is a good thing (especially with the uninstaller tool being so out of date, at least a year old). Though, after it allows for an error free install of ESET 6.5. 

 

Jdashn

Link to comment
Share on other sites

We see our own log files is that if you have HIPS - Self-Defense enabled it shows that ESET blocks actions against its own product, even a inplace upgrade of the ESET ERA 6.x Agent initiated from the ESET ERA console.

 

We tested this today, and captured over 100 different events in the HIPS logs (you have to manually enable logging for all blocked operations (AntiVirus Section - HIPS Section - Advanced Setup (click plus symbol) - log all blocked operations (Enable).  If you do not enable this feature operations blocked by built-in rules are not logged to the HIPS log in ESET.

 

ESET ERA component upgrade iinitiated from ESET ERA web console between 15:21:49 and 15:32:36 - Result: FAILED

Below are examples of blocking action taken by ESET (NO CUSTOM RULE, BUILT-IN RULES ONLY IN EFFECT)

 

hips_log.txt

Edited by Marcos
HIPS log moved to a file
Link to comment
Share on other sites

  • 4 weeks later...

For those who were wondering i was able to come to a solution to my issue with the assistance of ESET Support, after a few calls, and some log collecting the great team at ESET were able to find a solution to my Upgrade issue using their Install Repair tool. 

Have an awesome day!

 

Jdashn

Link to comment
Share on other sites

@FailedExpermient 

I would certainly contact support, refrence this ticket. The tech I spoke with told me that he'd never seen another user that had the same issue that I ended up having.

That said, I was able to find the 'Eset Install Fixer' by searching for just that. hxxp://support.eset.com/kb3544/?viewlocale=en_US

I'd honestly make sure that it's the same issue, contact support, get it REALLY figured out before trying out the tool.. I'm not sure, but it could cause more harm than good if not used properly!

 

I totally hope this helps though!

 

Jdashn

Link to comment
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...