I can't update agents or Endpoint to new versions from ESMC

[sanlucas 0]

Hi, I have client database connections and updates correctly.
But I can't update agents or Endpoint to new versions from ESMC
I use the ESMC native proxy

 

ESMC Server data:
ESET Security Management Center (Server), Version 7.0 (7.0.471.0)
ESET Security Management Center (Web Console), Version 7.0 (7.0.429.0)
CentOS (64-bit), Version 7.6.1810
Update module 1072.1 (20190626)
Translation support module 1751 (20190625)
Configuration module 1740.3 (20190326)
SysInspector 1274 module (20180918)
SSL module 1031 (20190405)
Push notification service module 1053 (20190321)

 

LOGS CLIENTS:

status.log:

OK

 

lasterror.html:

CSystemConnectorModule: 2019-Aug-06 13:33:48 : Software installation failed: GetFile: Failed to process HTTP request (error code: 20019, url: 'hxxp://repository.eset.com/v1//info.meta')

 

trace.log:

2019-08-06 13:00:51 Warning: CEssConnectorModule [Thread 328]: Set policy request to product was successfull
2019-08-06 13:33:48 Error: CSystemConnectorModule [Thread 698]: Software installation failed: GetFile: Failed to process HTTP request (error code: 20019, url: 'hxxp://repository.eset.com/v1//info.meta')

------------

LOGS PROXY:

access_log |grep 4.62:

192.168.4.62 - - [06/Aug/2019:10:48:20 -0300] "POST hxxp://i4.c.eset.com:80/ HTTP/1.1" 200 2094 "-" "-"
192.168.4.62 - - [06/Aug/2019:10:54:09 -0300] "HEAD hxxp://update.eset.com/eset_upd/ep6/update.ver HTTP/1.1" 401 - "-" "ESS Update (Windows; U; 32bit; PVT F; BPC 6.5.2107.1; OS: 5.1.2600 SP 3.0 NT; TDB 42329; CL 1.1.0; LNG 13322; x32c; APP eea; ASP 0.0; PX 1; PUA 1; CD 1; RA 1; PEV 33710; UNS 0; SHA256 0; WU 2; HWF: 01008641-2222-2A48-EC6E-B3F30E66A475; PLOC es_cl; PCODE 107.0.0; PAR -1; ATH -1; DC 1; RET 0)"
192.168.4.62 - - [06/Aug/2019:10:54:10 -0300] "GET hxxp://update.eset.com/eset_upd/ep6/update.ver HTTP/1.1" 200 10803 "-" "ESS Update (Windows; U; 32bit; PVT F; BPC 6.5.2107.1; OS: 5.1.2600 SP 3.0 NT; TDB 42329; CL 1.1.0; LNG 13322; x32c; APP eea; ASP 0.0; PX 1; PUA 1; CD 1; RA 1; PEV 33710; UNS 0; SHA256 0; WU 2; HWF: 01008641-2222-2A48-EC6E-B3F30E66A475; PLOC es_cl; PCODE 107.0.0; PAR -1; ATH -1; DC 1; RET 0)"
192.168.4.62 - - [06/Aug/2019:11:06:09 -0300] "POST hxxp://ts.eset.com:80/query/chsquery.php HTTP/1.1" 200 - "-" "-"
192.168.4.62 - - [06/Aug/2019:11:06:10 -0300] "POST hxxp://ts.eset.com:80/query/chsquery.php HTTP/1.1" 200 55 "-" "-"
192.168.4.62 - - [06/Aug/2019:11:06:11 -0300] "POST hxxp://ts.eset.com:80/query/chsquery.php HTTP/1.1" 200 - "-" "-"
192.168.4.62 - - [06/Aug/2019:11:06:11 -0300] "POST hxxp://ts.eset.com:80/query/chsquery.php HTTP/1.1" 200 54 "-" "-"
192.168.4.62 - - [06/Aug/2019:11:08:21 -0300] "POST hxxp://i4.c.eset.com:80/ HTTP/1.1" 200 1926 "-" "-"

 

error.log:

[Tue Aug 06 07:55:42.435900 2019] [proxy_http:error] [pid 14409] (70008)Partial results are valid but processing is incomplete: [client 192.168.4.131:49182] AH01110: error reading response
[Tue Aug 06 08:22:46.006627 2019] [proxy:error] [pid 17018] [client 192.168.0.100:58244] AH00898: Connect to remote machine blocked returned by epns.eset.com:8883
[Tue Aug 06 10:23:08.667745 2019] [proxy:error] [pid 26599] [client 192.168.0.100:43330] AH00898: Connect to remote machine blocked returned by epns.eset.com:8883
[proxy:error] [pid 1185] [client 192.168.0.100:45838] AH00898: Connect to remote machine blocked returned by epns.eset.com:8883
 

 

 

[Marcos 5,074]

Are you able to create a software install task alright? Does a list of ESET's products in the repository populate while creating the task?

Do you have clients connected to the Internet via HTTP Proxy that is a part of the all-in-one ESMC installer? Is there no upper proxy server in use?

If you use a firewall, are all the necessary addresses allowed as per https://support.eset.com/kb332/?

As for the error "Connect to remote machine blocked returned by epns.eset.com", this is because clients have no direct connection to the EPNS server and HTTP Server cannot forward MQTT communication. As a result, sending wake-up call will not be possible.

[sanlucas 0]

Hi marcos:
1- I can't install anything from the ESMC, if for example I can activate licenses.
2- if the products are completed in the repository when creating the task
3 -if everyone uses the ESMC proxy to update the virus base because the terminals have no free internet output.
4- There is another proxy but in another IP address and only accessed with username and password
5- does the client firewall also have to allow the exit to the eset servers? Is the ESMC native proxy not used? or are you asking me about the server? (the server has free connection)

6- the error to epns.eset.com do I have to do something myself or is it part of the problem?

[Marcos 5,074]

Since you already have a proxy server in place, use it instead of the HTTP Proxy that is provided by ESET. Proxy chaining works only in case that the upper server doesn't require authentication (https://support.eset.com/kb7034/)

6. You could make it work only by allowing clients to connect to the Internet directly which is not possible in your case.

[sanlucas 0]

Hi marcos:
I cannot use the other proxy, I must use the ESMC proxy!
Many PCs do not have a proxy.
What should I review? I have placed a proxy in the policies and in the Endpoint.

[Marcos 5,074]

You wrote "There is another proxy but in another IP address and only accessed with username and password". Do you mean that clients don't already connect through this existing proxy server? Using HTTP proxy will work as long as it connects directly to the Internet and not to an upper proxy server that requires authentication.

[sanlucas 0]

Marcos, there are several scenarios on my LAN.

The only scenario I want what functions is:
Pc on the LAN, without internet connection, connecting to the ESMC server using the native ESMC proxy.

From the ESMC console I send an update to the PC without internet to update the client or the Endpoint and this task fails.

Error synchronizing package repository. Read the follow-up message for more details.

[sanlucas 0]

My connection would be like this:  

PC                            > Agent PC                               >    Server ESMC (free internet)            
Without Internet    > Proxy 192.168.0.100:3128    >    192.168.0.100
                                   pass: blank    
                                   user: blank    

[sanlucas 0]

Place the proxy of the company with username and password, that is, I do not use the ESMC proxy and it still gives me the same error:

GetFile: Failed to process HTTP request (error code: 20019, url: 'hxxp://repository.eset.com/v1//info.meta')

Could someone help me ????

[Marcos 5,074]

I'd definitely recommend contacting your local customer care and opening a support ticket.

You could also try to use a non-CDN repository as per https://support.eset.com/kb6749/. If possible, try connecting through a different ISP; we've had a case when the error 20019 was caused by a problem at user's ISP.

For support create a Wireshark log from the time when creating an All-in-one installer for further analysis.