CSA 5.1 - Test Mode Issue

[jmutuski]

We have a number of hosts who were in test mode, enabled full protection and then they move back into test mode within a day. There is no event generated and these hosts are part of a larger group of XP desktops that operate properly.

TAC suggested us to reinstall the agent, however this did not solve the issue and the systems continue to exhibit this behavior.

Has anyone experience this oddity?

[tsteger1]

How were they put into test mode?

Were they deployed that way with an agent kit, moved to a group, or already part of a group that was then put in to test mode?

[jmutuski]

They were initially deployed through an agent kit in test mode. After a period of testing/tuning, the entire group was put in protect mode. Now we have a small set of hosts that move back into Test mode with no interaction by and end user or administrator.

[tsteger1]

Sorry, more questions...

When you say "move back into test mode" is it via group membership (complete test mode) or rule module (partial test mode)?

Do you have any host managing tasks that move hosts to or from groups at specified intervals?

Tom

[jmutuski]

They hosts show back in the Test Mode group. There are no host managing tasks to move any host to any group.

[tsteger1]

Sorry, I guesss I'm a bit confused. I thought you changed the original group from test to protect but it sounds like you moved them to a protect group.

It sounds like something I've seen where hosts will disassociate themselves on their own. They actually unregister from and reregister to the MC and end up in the original group they were deployed in.

Check the registration date and see if it corresponds with the time you saw them move to the test mode group.

If that's the case, you may have a configuration or communication issue on the hosts that are doing this.

I think TAC was trying to get you to install a kit that puts them in the group you want them to be in.

This is not an unknown problem but I don't know the solution.

Tom

[chickman]

Tom,

This could be the same issue we were facing with hosts reverting back to their installed agent kit. I'm curious as to which CSA version you are running? I'll interject my ideas once I see that. On the bright side, test mode is a safe way to revert back to, could have been worse.

[jmutuski]

5.1.079

[chickman]

Bam! That is the same one I was having issues with. Look to upgrade to 88 or 91 and your problems should be resolved.

My issue was very odd to where I would have hosts drop out of their groups and revert back to the installed agent kit. Which meant that any groups I had assigned after the kit was installed were now unassigned. This was a bad situation as we had used the standard kits for several hosts. These didn't include our exception policies or anything, so things were firing like mad, mucking up our reports.

***Side note, this did not happen with 66. I went ahead and got a hair and pushed 79 out to all hosts and then several days later these random problems began. I had a TAC open, but they only suggested the same thing, REINSTALL. It didn't work, then 88 became available, so I pushed it. That was the fix to my issues, and I hope it will be to yours.

[tsteger1]

I'm running 4.0.3-737. I haven't had it happen to any of the 5.X versions (yet).

[TradeSecrets]

1) Make sure all the agent have the new policy.

Have the agents do a stop and start or reboot

2) Verify the problem host agents are in the Test mode group.

3) If the above do not work. check the logs on one of the problem host for further investigation

[chickman]

Did you happen to figure your issues out? I'm curious if it cleared on its own or if you had to update. Let us know! =)

[jmutuski]

Not yet as the client is a bit gunshy upgrading as the last time they did it resulted in a lost configuration. If/when I will update the thread.

[chickman]

Well, updating isn't like you're thinking, or maybe it is. The upgrade can be pushed out from the MC. You simply upload the package to the MC and select the devices to push to. It really is quite easy. Best of luck for when you do update.