We have a non-production instance of Flexera that we don't use too often.
Recently we started using it again.
We have an issue that the Reconcile button in the WebUI seems to do what it expected. It says that a license reconcile has been scheduled. But nothing happens. No error, no reconciliation result, no running tasks.
When we run compliancereader.exe on the server, it does its job. There is a lot of actions, it takes quite some time and after it is done, in the WebUI we see that there has been a succesful reconciliation and the results are visible in the system tasks.
What can be the reason for the reconciliation via the WebUI to not have any results? Are there really no errors or am I not looking in the right place?
Jun 29, 2022 12:16 PM - edited Jun 29, 2022 12:17 PM
I have seen this issue occur before, where the nightly reconcile works, however, a manually triggered reconcile never starts. This is most often due to an issue with the Messaging Queues on the servers. Because the biggest difference between the reconcile run from the scheduled task, and one triggered manually from the FNMS UI is that the latter uses the Microsoft Messaging Queues.
I would recommend that you check that the Messaging Queues are running and that the service account has the ability to send and receive messages on the 4 FNMS messaging Queues.
You can also remove the messaging queues, and recreate them using the Config.ps1 PowerShell script. This script initializes the Messaging Queues and can reset them if there are issues.
Jun 29, 2022 01:42 PM
It took me some time, but I have found the Message queues (via Computer Management) and noticed that all queues were not accessible. With a hack (see https://stackoverflow.com/questions/781154/no-permission-to-access-a-private-msmq) I managed to get permissions and also gave permissions to the local admin group.
After that, the queues look good. I can see and edit the properties. And I hopefully started another reconciliation via the WebUI.
But unfortunately, still no result.
No succesful reconciliation, no errors (as far as I can tell), I also did not see the queues being used.
I think this was a step in the right direction and that there definetely was something wrong with the MSMQ config. But I may need a bit more help.
Can I find documentation that explains the process flow (what happens after you click the Reconcile button, which programs and components are executed etc)?
Jun 30, 2022 03:23 AM
I am not aware of any documentation that goes into details about the manually reconilation process, or what exactly is triggered. However, it is possible that someone has created a custom document for that process.
Jun 30, 2022 02:25 PM
Regardless of documentation, does anyone know what the reconcile button triggers and how it eventually should lead to an avtivity in MSMQ?
In my case, something is wrong (it does not work), but I don't know where to look and can't find any errors.
Jul 01, 2022 04:12 AM
@jhofstede - When you manually try to launch the import from the UI, what do you see in the Batch Processor Log files?
Jul 08, 2022 07:08 AM
Run as service account (or user with DB permissions) the following command in an elevated CMD:
C:\Program Files (x86)\Flexera Software\FlexNet Manager Platform\DotNet\bin\BatchProcessTaskConsole.exe list-tasks
This will show you a list of pending and running tasks. If there is a long list of outdated and pending tasks, use the fail-tasks parameter to remove the old records.
Each time you run the compliance import for example, a record is being created in the MSMQ which you can see in the batchprocesstaskconsole
Jul 08, 2022 07:52 AM
When I execute that executable, there is a message saying:
No tasks waiting for execution or in progress.
The UI however tells me (half an hour after I have hit the reconcile button) that the last reconcile was succesful and that this was a week ago.
Jul 08, 2022 08:44 AM
I just ran another reconciliation and immediately checked the first logging. It had not been updated yet, but it is full with warnings:
Failed to open or read from message queue fnmsBatchProcessorTask. Error: Flexera.MessageQueue.MessageQueueInitializationException: Cannot read from queue; the current user may not have sufficient permissions, or the host address may be incorrect. Queue address: FormatName:DIRECT=OS:[host]\private$\fnmsBatchProcessorTask
Failed to open or read from message queue fnmsBroadcast. Error: Flexera.MessageQueue.MessageQueueInitializationException: Cannot read from queue; the current user may not have sufficient permissions, or the host address may be incorrect. Queue address: FormatName:DIRECT=OS:[host]\private$\fnmsBroadcast
The other folder does not exist unfortunately. But it is likely that the user that is trying to access MSMQ does not have the right permissions.
In IIS all application pools have the identity of the service account, which is part of the administrators group.
And the administrators group has full permissions to the queues.
Just to be sure, I have also added the service account directly to the permissions of these two queues.
But the results is still the same: Failed to open or read from message queue.
I assume I am (again) not looking in the right place for the permissions. Any idea where I should go?
Jul 08, 2022 08:42 AM
I would suggest to rerun the Powershell config again as the service Account. the config scripts from Flexera install and configure MSMQ.
Run the config scripts with the flag forceupdateconfig
Jul 11, 2022 01:47 AM
I have started a powershell window as the service account and executed .\Config.ps1 "Config\FNMS Windows Authentication Config.xml" forceUpdateConfig
After that, I had to re-enter the username and password for two application pools.
I ran another reconcile and as far as I can tell, nothing seems to have changed. According to the Flexera WebUI the last succesful reconciliation was still two weeks ago.
And in the BatchProcessorLog there is still the same warning:
[WARN ] Failed to open or read from message queue fnmsBatchProcessorTask. Error: Flexera.MessageQueue.MessageQueueInitializationException: Cannot read from queue; the current user may not have sufficient permissions, or the host address may be incorrect.
I have the impression that the MSMQ config has not changed despite running the config with -forceUpdateConfig
But not sure if this is true, how I can verify it and what to do about it.
Jul 15, 2022 06:04 AM