OS X - Agent stops functioning

[j-gray 31]

I've raised this issue before, but haven't gotten anywhere so far and am trying to get an idea of how many others might be having this issue as well...

We're finding that numerous OS X remote agents quit working randomly. Clients then appear as unmanaged in the ERA console. For each client, status.html shows all green with successful history, but last timestamps will be weeks or months old. Last-error.html shows nothing noteworthy.

Attempts to either reinstall the agent manually, or upgrade the agent manually result in the following error:  "The upgrade failed (The Installer encountered an error that caused the installation to fail. Contact the software manufacturer for assistance)."

The only method I've found to resolve this is to run the agent uninstaller, then install the agent. Not really an option for hundreds of workstations.

I've opened a case with ESET Support, but after a week, all I've gotten is a recommendation to uninstall and reinstall the agent. Again, not really an option for hundreds of workstations.

If anyone cares to chime in with similar experiences, possible resolutions or other feedback, I'd appreciate it.

[j-gray 31]

Still looking into this while I wait for support...

So far I've found this to occur with agent versions 6.2.166.0, 6.4.232.0, and the latest, 6.5.376.0

I'm just not seeing anything that indicates why the agents stop working. Firewalls are off, configs are consistent across machines, etc. One works fine while the one next to it is broken.

[Peter Randziak 946]

Hello J-gray,

one of my colleagues says that it might be caused by the agent crashes, so we would need a logs collected from the affected machines to be able to look into it.

Regards, P.R.

[j-gray 31]

Thanks, Peter.

I heard back from support yesterday. They advised to upgrade the agent, but as I had detailed earlier, attempts to upgrade the agent fail.

What logs are required, specifically and what method to obtain them?

[Peter Randziak 946]

Hello J-gray,

the info_get script for macOS should be able to collect all data required, it can be downloaded from this KB article http://support.eset.com/kb3404/?viewlocale=en_US

Regards, P.R.

[j-gray 31]

Thanks, I'll do that.

Odd that support hasn't asked for any logs, as yet. It's been a week since I heard anything on the case.

This forum seems far more responsive than our paid support --which is both awesome and frustrating at the same time.

[Peter Randziak 946]

Hello J-gray,

I've seen a case with a very similar issue as you described. As a root cause was identified a SQLite DB corruption. macOS does not flush data to file system immediately, but delays it due to optimization. In case of system failure like power outage, it can cause DB corruption and thus fail of application relaying on data from it.

In case you have the logs please send me a private message with a reference to this thread.

Can you please also pack contents of  /Library/Application Support/com.eset.remoteadministrator.agent as it may be important for the analysis as well.

If you provide me with the ticket ID and information about the partner / reseller I may try to check it. 

Thank you, P.R.

[j-gray 31]

Just to follow up, support has determined that database corruption at the client is the issue. As Peter stated, likely caused by hard shutdown of the client.

The only recommendation support provided for fixing the issue is to use a third-party tool like ARD to uninstall/reinstall the agent.

So I'm now left to figure out how to find unmanaged systems that are actually online, determine if they have the agent installed, then determine if the agent is broken, then uninstall/reinstall the agent.

Any suggestions for accomplishing the above are much appreciated.

[Peter Randziak 946]

Hello J-Gray,

probably the easiest way would be to filter the clients with Last connected exceeding defined threshold.

Regards, P.R.