Using 'AppStart' with 'AppUpdate'

[CChong]

According to the documentation, using the AppStart argument with AppUpdate will silently end the update process if there is no internet connection.

What happens though if there IS an internet connection but the Update Services website is down?

This appeared to happened last week (site was unavailable) and it was causing my program to lock up and not start - I was using the AutoUpdate method at the time and not AppUpdate. I'm hoping that using AppUpdate with AppStart will fix the potential problem. But, of course, there is no easy no to test for this, outside of waiting for the Update Services website to be unavailable again.

[CChong]

We use AppStart with AppUpdate. I tested this scenario by configuring our firewall to block access to updates.installshield.com (the update URL). Our application loads just fine with no errors if an Internet connection is present and this URL is blocked. This test was run with Update Service v. 1.20.

[Chris_Woerner]

Your posting is pretty accurate. Let me quickly describe the behavior of the two functions related to connectivity checking.... There is more information on AppUpdate in the help and in KB article Q106331.

AppUpdate() - AppStart: Checks for an internet connection. First, it asks Windows if a connection is present. Unfortunately Windows sometimes tells you a connection is there when it isn't. So as a second check, it pings the Update Service server. If there is no connection (or no server), the AppUpdate will end silently.

AutoUpdate(): This doesn't perform a check for an internet connection. If you are using this call, we HIGHLY recommend that you first call IsConnected() to determine if a connection is present. That will avoid your application locking on you. I think you found this the hard way. Sorry about that. I will look to improve our documentation on this.

[CChong]

So, behind a firewall, what ports need to be open for Update Service to think that a connection is present (besides HTTP and HTTPS)?

We are seeing strange behavior behind ZoneAlarm, Sygate, and Novell firewalls in Update Service v. 1.20 where an Internet connection is present but Update Service will not recognize it. It says "An Internet connection is needed to view your updates. Click Retry after connecting to the Internet." Normally, ZoneAlarm and Sygate will prompt the user, asking if they want to allow access for Update Service. This is not happening with v. 1.20.

Zone Alarm users are reporting that if they leave Internet security setting at High (the recommended setting), Update Service will not recognize the connection. If they set it to Medium, it will recognize it. It is not prompting them as it does for other applications.

Any suggestions?

[Chris_Woerner]

The Update Service just uses standard HTTP (port 80). If we tried to use anything else, we would get blocked by too many firewalls - especially in the corporate environment.

We did test w/ Zone alarm. During our test, it did prompt to allow the Update Service (Agent.exe) to connect. I don't remember which settings we used. We will go back and revisit later today or tomorrow.

Can you provide any more information on the ZoneAlarm configurations that are failing? Is it a vanilla install with no custom setting?

We haven't tried Sygate. We will give that a try. I assume that it is their Personal Firewall 5.0 software? Again, any information on the settings would be helpful.

[CChong]

This has also been reported behind a firewall on a Novell network. In all cases the users can browse normally, but Update Service thinks no connection is present. Is it possible that the PING is using a commonly-open port other than 80?

I'll check on the exact firewall settings with our beta sites and get back to you. Thanks for your valuable help on this.

[CChong]

I can not reproduce the problem using ZoneAlarm and SyGate. I tried it on Win 98 and XP.

Zone Alarm:
I get internet alert for Update Service Agent when I launch the application. Alerts stopped, if I have asked Zone alarm to remember the settings.
I used High security settings for both Program Control and Firewall.

Sygate:
I also tried Sygate, it also prompted with an alert.

Can you please provide me more information about:
1. Operating System
2. IE Version
3. What are the settings of your ZoneAlarm - if possible please attach the screen shot of Programs tab. In particular, whether InstallShield Update Service Agent is listed in Programs tab of Program Control of Zone Alarm?

Thanks,
Sandeep

[CChong]

Update Service seems to work fine when the application first starts up, as you described (AppUpdate with AppStartup option). The error occurs when they MANUALLY try to check for updates (AppUpdate with AppMenu option). In that case, the update service tells them to establish a connection and retry, even though a connection already exists and it was recognized by AppStartup.

Did you test the AppMenu option?

[Chris_Woerner]

To answer your question, we did test with AppUpdate/ AppMenu as well.

Not to ask a stupid question, but are you sure it works fine during application startup (AppUpdate/ AppStart)? If AppUpdate cannot establish a connection during start-up, it ends silently. It does not prompt for a connection.

[CChong]

Good point. To be clear, I should say that the users don't get the error message with AppStartup. I'm not saying that it is connecting.

I will reply with version information, etc.

[CChong]

I have the information from beta sites who are getting the ISUS Agent message about not having an Internet connection when a valid connection exists. This message appears when the user manually checks for updates (AppUpdate with AppMenu option).

Note: All of these users appear to have both Netscape and Internet Explorer installed. Is that significant?

From Beta Site 1: ------------------------
1. I am running Windows 98SE
2. The Internet Explorer version is 5.00.2614.3500.
My Netscape version is Netscape 6.2 Mozilla/5.0 (Windows; U; Win98; en-US; rv:0.9.4) Gecko/20011019 Netscape6/6.2
3. I run ZoneAlarm with Local Security set on Medium and Internet Security set on High. InstallShield Update Service is the first entry at the top of the Program list of programs. I have attached another screen shot (ZoneAlarmBeta1.jpg) of the top of the list from the Program entries of my ZoneAlarm Control Center. As you can see, InstallShield Update Service Agent is the first entry.

"Having to reduce the level of Internet security to install an update of AQ is something I hope you can find a way around. I also dislike having to run MS Internet Explorer for any reason because of Internet Explorer's susceptibility to attack by viruses and worms. When I am forced to run it, AND reduce the
security level of my firewall, I get uncomfortable. The InstallShield people need to recognize that not everyone is a Microsoft enthusiast, and that some of us object to downgrading protective measures for our systems in order that their software can do its job."

From Beta Site 2: ------------------------
1. My operating system is Windows 2000 pro Version 5.0.2195, Service Pack 3, Build 2195
2. Internet Explorer Version 6.0.26; NetScape Version 4.7 is installed but I never use it (you can tell from the old version)
3. As-yet-undetermined firewall on a Novell network at an educational system

From Beta Site 3: ------------------------
1. Operating system = ME
2. IE = V. 6.02.2600, Netscape = V.6.2.1
3. Sygate v. 4.2 - has Installshield set at "ASK".
Gives intermittent messages telling him he has no internet connection; no discernable pattern to when it allows access and when it gives the error. Sounds like he's right at the edge of some kind of timeout/latency issue?

[CChong]

Beta site 1 was running ZoneAlarm 2.1.25 (published 2 years ago). I asked him to upgrade to the current version (3.1.291). He did, and there was no change in behavior. His new settings show that InstallShield Update Serviced has been granted Trusted and Internet Access. Under the "Server" column, Trusted and Internet both have question marks, indicating that this access has never been requested nor granted.

Beta site 3 (Sygate v. 4.2) has clarified their response, and it is worse than I thought:
If in ASK mode (ISUS is not automatically granted or denied access), Update Service always gives the message about not having an internet connection. Sometimes it gives the message about not having an internet connection even if you have permanently allowed access to ISUS.
The Advanced Application Configuration is set thusly:
Allowed during screensaver mode
No trusted IP's selected
Port #'s blank (not selected) - Remote & local and TCP &UDP
No Scheduling selected

My take:
I wonder if this is a Netscape/IE issue. All of these users have both browsers installed. Some have complained that Update Service will not launch the Netscape browser even if it is their primary browser. Does Update Service support Netscape browsers? What if a user only has Netscape installed?

[CChong]

I could not reproduce the problem both with ZoneAlarm and Sygate software.

I had the same versions for IE, Netscape, and firewall software on Win 98SE and Win ME machines as you described. I also had the same settings in the firewall software as well.

The only thing I noticed that if you don't response to the Update Service Agent alert presented by the firewall software for about 4-5 seconds, the you get prompted with Retry dialog which is OK because Update Service Agent pings the server to check for the connection for only 2 seconds.

In order to narrow down the problem, I am attached a zip file that contains two reg files. The AddValue reg file will disable the checking of internet connection by the Update Service. The purpose is to determine if it is just a timing issue. The RemoveValue reg file will enable the internet connection checking by the Update Service.
Can you have user merge them on the machine in following sequence?
1. First reproduce the problem as usual to make sure it is still reproducible.
2. Merge the reg file AddValue on the machine.
This should disable the internet connection checking by Update Service.
3. Check for Updates from Menu and/or at application launch.
Please let us know whether the IE browser window launched and showed updates after Update Service was granted an access by the firewall software.
4. Now merge the reg file RemoveValue on the machine to enable internet connection checking by Update Service.

This is to let you know that Update Service requires at least IE 4.01 to be present on client's machine. Although IE does not has to be the default browser on the machine but Update Service always uses IE to show updates. Netscape is not a supported browser at present.

Thanks,
Sandeep

[bryantlk]

From my testing experience, a firewall problem exists between the Update Service and ZoneAlarm that will have quite a negative impact with users of the Update Service and developers.

Condition: ZoneAlarm Program Control setting for Internet Explorer: PRIVACY=ON. The PRIVACY=ON appears to become a default for IE. (I am using IE 6.0).

Scenerio: Check for Updates, View Updates, HTML page shows up, Show Updates, Get Update(nothing more occurs).

The Update Service is blocked from viewing more data on my machine. There are no messages shown.

My work around is to leave PRIVACY=ON for Internet Explorer and add the Update Service server IP address to my ZoneAlarm's trusted Zone.

Sending an email to my future gazillion customers telling them to apply the InstallShield server IP address to their firewall software parameters is not a good way to resolve this, nor does it help business sales and customer relationship.

If anyone has a solution to this serious problem, I would very much appreciate a reply.

Is it possible that the Update Service Agent will need to function as a server with proxy rights to the browsers?

[CChong]

Sandeep:

Results from your test with Beta site 1:

1. Behavior was reproduced. Note that at application launch (AppUpdate with AppStartup) a ZoneAlarm popup appears: "The firewall has blocked Internet access to updates.installshield.com (12.107.125.101) (HTTP) from your computer (TCP flags: S)." No application name is given, and that bothers me. It's as if ZA thinks the OS is trying to access the Internet rather than a specific application it can track.
NOTE: ZALog.txt log file is attached showing the block events.

2. File was merged successfully.

3. When user checks for updates (AppUpdate with AppMenu) the InstallShield Wizard window showed, displaying the message, "Update Service is checking for updates," but with no active buttons. There was NO IE BROWSER WINDOW. User clicked on the "X" to close the window. (AppUpdate with AppStartup produces no messages.)

4. Second file successfully merged and user tried again. "Currently another session of Update Service is running on your Machine" appeared when user checked for updates. User had to wait another 3 minutes to get rid of the message about another session of US running, since they had closed the IS Wizard window. (This timeout issue has been reported separately to tech support with no reply.) Once the previous session timed out the IS Wizard window displayed the original Update Service message saying no Internet connection was available.

5. The user reports that Update Service works correctly only if he reduces ZoneAlarm Internet security to Medium OR if he adds updates.installshield.com (12.107.125.101) as a Trusted IP address. He is not happy about either of these options.

Sandeep, your testing copy of ZoneAlarm doesn't happen to have 12.107.125.101 listed as a Trusted IP address, does it?

[CChong]

Here is the log file I fogot to attach to the previous post.