ARL Imports Failing for FNMS On-Prem

[dbeckner]

Our ARL imports have been failing on all our lab and customer systems since 6/28. I saw the post referencing the SSL changes, but we are not whitelisting by IP so I am not sure that it applies here. Is anyone else seeing this issue?

I have attached the stack trace.

[jjoaquin]

Hi,

I'm also having a problem with ARL Import as we speak. The last update as per process was 25th of June but I'm on version 2612 yet still, it says ARL Import failed on system tasks. I tried running the MgsImportRecognition.exe and I'm getting the error message:  The underlying connection was closed: An unexpected error occurred on a send.

[joshua_neadow]

I just opened a case for our implementation as well.  We are getting a connection interrupted or ended error but our networking team said everything is going through fine on our end.  Glad we arent the only ones.

[daniel_klein]

Hi,

same here. First thought was it depends on the SSL/IP change that Flexera made to the URLs: https://community.flexera.com/t5/FlexNet-Manager-Content-Blog/www-managesoft-com-amp-update-managesoft-com-IP-Address-and-SSL/ba-p/196656/jump-to/first-unread-message

But the manual download works fine, so it can't be a problem with my local internet/whitelist/config.

[dbeckner]

I thought the same thing so I imported the CRL and Cert that was provided in that post, but it didn't resolve the issue. I am also able to manual download by hitting the URL in the browser.

[joshua_neadow]

Same with us, Our Networking team verified there is nothing blocking/preventing/or hindering our connections to the site for download.  looks to be site/server related on flexeras end.

[jjoaquin]

What exactly do you mean when you say download works fine?

[joshua_neadow]

if you follow the manual steps of obtaining the ARL files, there isnt an issue.  its only the connection job that seems to fail.

[daniel_klein]

exactly 🙂

[dbeckner]

@jjoaquin If you open a browser on the server and navigate to the RecognitionAfter82 url from the stack trace you can see if your network is blocking traffic from your server to the managesoft content site. This is usually a good first step when you have issues with the ARL Import. The download should kick off immediately when you browse to the site. For me I can download it directly from there, but the automated import is failing.

The link is below.

https://www.managesoft.com/support/Compliance/RecognitionAfter82.cab

[jjoaquin]

I was able to download that file and the PURL.cab with no problem but after putting them on the data import and reprocess data import they vanish.

[daniel_klein]

yes, that's how it works. They were downloaded and imported. No files left. Did you run the import by using the command or just started the scheduled task manually?

[jjoaquin]

From task scheduler...ah ok so its normal but still it shows the ARL Import still failed.

[dbeckner]

@jjoaquin Try going to %systemdrive%\ProgramData\Flexera Software\Compliance\Logging\Content and check the mgsRecognitionImport.log, importPURL.log, and recognition.log. That will give you some indication if the manual import was successful.

[jjoaquin]

both purl.log and recognition.log shows completed execution successfully but the mgsimportrecognitionimport.log gives an error having issues connecting to the webdownloader.

2021-06-30 05:40:19,464 [.RecognitionImportTool] [INFO ] ARL tasks (All) have begun...
2021-06-30 05:40:19,634 [onImport.ContentImport] [INFO ] Downloading (using WebDownloader) https://www.managesoft.com/support/Compliance/RecognitionAfter82.cab
2021-06-30 05:40:20,259 [onImport.ContentImport] [WARN ] RecognitionAfter82.cab download attempt 1 of 5 failed with System.Net.WebException: The underlying connection was closed: An unexpected error occurred on a send.
2021-06-30 05:40:20,259 [onImport.ContentImport] [INFO ] Waiting 10 seconds before trying again
2021-06-30 05:40:31,117 [onImport.ContentImport] [WARN ] RecognitionAfter82.cab download attempt 2 of 5 failed with System.Net.WebException: The underlying connection was closed: An unexpected error occurred on a send.
2021-06-30 05:40:31,117 [onImport.ContentImport] [INFO ] Waiting 20 seconds before trying again
2021-06-30 05:40:51,739 [onImport.ContentImport] [WARN ] RecognitionAfter82.cab download attempt 3 of 5 failed with System.Net.WebException: The underlying connection was closed: An unexpected error occurred on a send.
2021-06-30 05:40:51,739 [onImport.ContentImport] [INFO ] Waiting 40 seconds before trying again
2021-06-30 05:41:32,605 [onImport.ContentImport] [WARN ] RecognitionAfter82.cab download attempt 4 of 5 failed with System.Net.WebException: The underlying connection was closed: An unexpected error occurred on a send.
2021-06-30 05:41:32,605 [onImport.ContentImport] [INFO ] Waiting 80 seconds before trying again
2021-06-30 09:38:57,209 [.RecognitionImportTool] [INFO ] ARL tasks (Cleanup) have begun...
2021-06-30 09:38:57,264 [onImport.ContentImport] [INFO ] Cleaning folder "C:\ProgramData\Flexera Software\FlexNet Manager Platform\DataImport\Content\ARL"
2021-06-30 09:38:57,269 [onImport.ContentImport] [INFO ] Cleanup completed in 003ms
2021-06-30 09:38:57,269 [.RecognitionImportTool] [INFO ] ARL tasks (Cleanup) have finished successfully.
2021-06-30 09:38:57,359 [.RecognitionImportTool] [INFO ] EOSL tasks (Cleanup) have begun.

[jjoaquin]

Thanks for the tip by the way regarding checking of the logs...that helped me understand more of the status.

[sreeramyenuga]

Hi,

Same issue occurred in our environment also, we added https://update.managesoft.com in the trusted sites then after it's  able to download .cab files and can telnet to update.managesoft.com port 443.

Today we are not seen any error on ARL.

Thanks,

Sreerama Yenuga.

[pyadav · Accepted solution]

Flexera rolled out a change to the network configuration on the server that provides ARL files for download at 4pm June 30th Pacific Time (11pm June 30th UTC). Testing and feedback has indicated that this has resolved the reported download issues being discussed in this thread. No customer action is needed for this change to work.

Also, be aware of the recent IP address and SSL certificate changes noted in the following post: www.managesoft.com & update.managesoft.com - IP Address and SSL Certificate changes for FlexNet Manager Suite On-premises. These changes may require your action if you have configuration which restricts which IP addresses or SSL certificates your ARL download process can use.

Subject to the above comments, your next automated ARL import should complete successfully. If you are still encountering issues, please note your observations in this thread or raise a case with Flexera Support.

[DiannaB]

@pyadav  The scheduled task to download the ARL is still failing for us.  We added https://update.managesoft.com to trusted sites.  We also exported every certificate in the chain and imported each one in MMC.  I have an open case but any input here is appreciated.  Here's the latest error:  

2021-07-06 01:02:41,813 [.RecognitionImportTool] [ERROR] ManageSoft.Compliance.Logic.Core.Impl.Licensing.RecognitionImport.ContentDownloadException: Could not download https://www.managesoft.com/support/Compliance/RecognitionAfter82.cab ---> ManageSoft.Compliance.Logic.Core.API.ImportRecognitionDownloadException: Failed to download the file 'https://www.managesoft.com/support/Compliance/RecognitionAfter82.cab' to 'C:\ProgramData\Flexera Software\FlexNet Manager Platform\DataImport\Content\ARL\RecognitionAfter82.cab'. ---> Flexera.Web.Client.MaxAttemptsExceededException: One or more errors occurred. ---> System.Net.WebException: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel. ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure.

If we go to https://update.managesoft.com from a browser on the app server, it says NET::ERR_CERT_AUTHORITY_INVALID and it won't automatically download the file.

Also, for each of the five certificates in this chain, when I open each one from the batch/inventory server, it says "Windows does not have enough information to verify this certificate".   If I open them from my laptop, the only one it complains about is the Starfield Class 2, but that one doesn't show up in the certification path when I open the managesoft cert from my laptop.  It does appear in the chain when I open it from the server.  

[DiannaB]

Follow up from my previous post.  I had to get the "right" Starfield Class 2 Certification Authority cert from here (https://aws.amazon.com/blogs/security/how-to-prepare-for-aws-move-to-its-own-certificate-authority/) to resolve this issue.