Product version status and packet installer issue

[Dud3 0]

Hello,

i have the following problems with our ESET Protect environment.

 

A Few weeks ago i update the EMC to ESET Protect and after a 2 weeks i noticed that the "Product version status" dashboard was showing me the "Agent" status in grey instead of green or red. 

 

 

I am using ESET PROTECT (Server), Version 8.0 (8.0.1258.0)  and for the clients ESET Management Agent 8.0.1238.0

 

And the second problem:

 

When i try to create a new "all in one installer package" i cant find any version for my client (ESET Endpoint Security 8.0.2028.0) the repository is not empty i find packages for ESET Server Security.

 

King Regards

 

 

Edited April 13, 2021 by Dud3

[Dud3 0]

does anybody got an idea? 

[MartinK 378]

Could you please check EP's trace.log for possible network-related issues? It seems that communication with ESET repository servers might be failing and thus EP is not able to decide whether installed version is latest or not.
Also what platform, DB type are you using? What was previous ESMC version used before upgrade?

[Dud3 0]

Hello MartinK,

 

thanks for your reply.

I am using MSSQL Server 2014.

 

I uploaded a short summary of logs from a client

 

From the client i can reach the server on port 2222, tested with telnet.

 

Quote

What was previous ESMC version used before upgrade?

How do i determine this?

 

Best Regards

log.txt

[MartinK 378]

Actually I was referring to EP Server's logs, located in C:\ProgramData\ESET\RemoteAdministrator\Server\EraServerApplicationData\Logs in case of EP for Windows, but in case there are only clients that are not able to connect to EP, it might also explain why version check is not working as intended.

From provided logs it is fairly clear that AGENT on client devices is not able to connect to EP because of DNS-resolving issue - could you double check that hostname as was printed in logs is correct and can be actually resolved to IP address on client device?

[Dud3 0]

Hello MartinK,

 

i uploaded the trace.log from the EP Server.

 

I put a VM in the same subnetwork as the EP server and the agent status is still unknown /grey.

I also triple checked the name resolving, on the VM with nslookup and ping. The client can resolve the IP of the EP Server.

 

The problem is not only on windows clients also on MAC OS, Windows 10 Clients and Windows Servers.

 

Could you tell me what i should check within the configuration policy's?

  

Best Regards

 

trace.log

[Dud3 0]

@MartinK are the provided information helpful?

[MartinK 378]

5 hours ago, Dud3 said:

@MartinK are the provided information helpful?

Unfortunately not, as it contains only 3 minutes of data, and synchronization with ESET repository servers is most probably not covered, as it happens only once an hour ... but I have passed to others, whether they have not seen such behavior previously.
But it might help to also provide trace log covering first minutes after service EP restart, there is a higher chance it will cover also possibly problematic part.

[Dud3 0]

@MartinK

 

i restartet the "EP Server" - Service and Uploaded the Logs trace0.log

 

i hope these a helpful and give us a hint about the problem

trace1.log trace2.log trace3.log trace4.log trace5.log trace.log

[MartinK 378]

On 5/6/2021 at 11:54 AM, Dud3 said:

@MartinK

i hope these a helpful and give us a hint about the problem

Checked logs and there are entries like this:
 

2021-05-06 09:37:38 Information: CRepositoryModule [Thread 163c]: CMetadataProcessorV3:http://repositorynocdn.eset.com/v1/com/eset/apps/business/era/agent/metadata3 is not synchronized (not exist in repository)

and alternatives for each product, indicating that indeed synchronzation with ESET repository servers is not working.
Could you please check you can actually download file from URL: http://repositorynocdn.eset.com/v1/com/eset/apps/business/era/agent/metadata3 on the same machine where EP service is running? Is there any firewall that could be blocking requests? I can see that non-standard ESET repository url is used, the one that directs requests to only ESET datacenters and not public CDN providers. Also please make sure HTTP proxy is properly configured and running, in case it is used.

[Dud3 0]

i can download the metadata3 file from this link hxxp://repositorynocdn.eset.com/v1/com/eset/apps/business/era/agent/metadata3 when im on the EP server. But only with the internet explorer, chrome isnt working.

 

The Server Firewall is deactivated for the tests, only the datacenter firewall is up.

i asked our network guys and they told me the firewall is not blocking.

 

at ->server settings-> advanced settings-> "using Proxyserver" is disabled (this settings describes how the EP server reaches the internet?)

at-> Repository i set -> hxxp://repositorynocdn.eset.com/v1

at-> Server settings-> Updates -> Update Server "Autoselect" 

                                                         -> delayed update

 

King regards

 

 

[MartinK 378]

What was actually reason why file was not possible to download using Chrome? That is actually what might point you the correct way, as from description you provided it seems to be that there might be some HTTP proxy used for accessing internet, and if so, also other applications has to be properly configured - this includes both Chrome but also ESET PROTECT Server itself, is the settings you described.
Before doing so, I would recommend to verify with "network gyus" or possibly check HTTP proxy configuration as can be accessed in "Internet Options" of your operating system or Internet Explorer configuration.

[Dud3 0]

Hello MartinK,

 

i could identify the cause of the problem.

Our firewall blocked the HTTP connection because of our application control within the firewall.

Everything was fine on layer 1,2 and 3.

thanks for your help