Dec 09, 2019
07:05 AM
RHEV is based on libvirt (implemented via oVirt) - I think it would work fine.
https://access.redhat.com/solutions/2074033
... View more
Dec 09, 2019
05:41 AM
Additionally, the first parts of the script will use the region that the beacon is installed in - but the later parts loop through the regions.
This is because when creating this adapter it was noticed that if you had EC2 instances in say, eu-west-1 - you'd not be able to see them if you queried us-east-1 - so we loop over all regions to get all the region's data.
... View more
Dec 09, 2019
05:35 AM
1 Kudo
It looks like you've found a bug caused by a use case we hadn't expected - well done 🙂
Am I right in assuming that one of your policies specifies multiple roles which it can assume? Similar to this?
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": "sts:AssumeRole",
"Resource": [
"arn:aws:iam::429345039360:role/TestRole_EC2",
"arn:aws:iam::429345039360:role/TestRole_EC22"
]
},
{
"Sid": "VisualEditor1",
"Effect": "Allow",
"Action": [
"sts:GetCallerIdentity"
],
"Resource": "*"
}
]
}
If so, then yes this is a bug which is because the adapter was not designed to handle cases where there'd be multiple resources on one policy. I was able to replicate your error by creating the above policy.
Would you please raise a support case referencing this community post and request that a bug is raised to track this issue?
I've attached a version I think should resolve this issue - but the bug may return if not permanently fixed in a later version of FNMS.
... View more
Dec 06, 2019
09:25 AM
2 Kudos
Hello @mag00_75,
Sorry to hear you're having trouble with our latest version of the AWS adapter. It was me who made the changes to this adapter - and I agree, the way we handle the region is poor.
I looked at this today and I made some changes which I hope you could possibly try to apply to your environment and see if the behaviour is more desireable?
Please first back up the original 'Logic.ps1' from the Batch server in the AWS adapter folder, this is typically located C:\ProgramData\Flexera Software\Compliance\ImportProcedures\Inventory\Reader\Amazon Web Services
Overwrite the file with the attached file on the Batch server
Run the connection in the beacon - which should download the updated file from the Batch server using the following command line (without the workaround you mention) - does it now connect to the desired location? ComplianceReader.exe -v -s "connection name" ComplianceReader.exe is located typically by default in C:\Program Files (x86)\Flexera Software\Inventory Beacon\DotNet\bin
Please provide the log output file.
... View more
Nov 12, 2019
06:19 AM
Typically these are available via the PLC under "Other Resources" - are you not able to see the "FlexNet Manager Platform Content Libraries"? These look recently updated from my view, if you can't see the same versions please raise a support ticket and attach any logs of the failures you mention.
... View more
Nov 11, 2019
09:31 AM
Are you also using a 2019 R1 beacon?
Could you upload the following:
Zip of C:\ProgramData\Flexera Software\Compliance\ImportProcedures
Copy of C:\ProgramData\Flexera Software\Beacon\config.xml
... View more
Apr 24, 2019
08:23 AM
2 Kudos
I would also add to back up the HKLM\SOFTWARE\WOW6432Node\ManageSoft Corp keys in case you have modified them and need to reference back to them.
... View more
Apr 24, 2019
05:03 AM
1 Kudo
There's also the possibility of using a folder junction to workaround this limitation, however I haven't tested this yet so I recommend to try it first on a development environment but I don't see it causing any ill effects as NTFS junctions are supported in .NET.
Using C:\ProgramData\Flexera Software\Compliance\Logging as an example:
1: Shut down the FlexNet Manager services and IIS or any component which has logs you wish to move.
2: Move the log "Logging" folder to the new location, such as D:\Flexera\FNMS\Logging
3: Use the following PowerShell command to create a folder junction:
New-Item 'C:\ProgramData\Flexera Software\Compliance\Logging' -ItemType Junction -Value D:\Flexera\FNMS\Logging
... View more
Feb 23, 2019
12:03 AM
Summary We have enabled Controlled Folder Access (CFA) and now Windows Defender is telling us that the agent is trying to modify files. Why is this? Symptoms We have enabled Controlled Folder Access (CFA) and now Windows Defender is telling us that the agent is trying to modify files. Why is this?
Cause As per Microsoft:
Controlled Folder Access in Windows Security reviews the apps that can make changes to files in protected folders. Occasionally, an app that is safe to use will be identified as harmful.
This is a false detection caused by the new CFA feature found in recent versions of Windows Defender (Windows 10 and Windows Server 2016). As the FNMS agent must run on multiple versions of Windows where CFA may or may not be present, the method in how the agent requests access and scans a machine could be seen as malicious activity by such a feature.
Steps To Reproduce
Resolution Add the agent to the list of CFA exclusions or turn off CFA. The instructions to perform this are available via the Microsoft link in the Additional Inforrmation section of this KB.
Workaround
Additional Information Allow a blocked app in Windows Security, Microsoft. Retrieved 28/11/18 Allow specific apps to make changes to controlled folders, Microsoft. Retrieved 03/12/18
Related Documents
Related KB Articles
... View more
Labels:
Jan 17, 2019
03:57 PM
Synopsis The OS which our Beacon is installed to was recently reimaged and we need to reconfigure our beacon to apply the same settings. How do we do this? Discussion Click the edit button next to the relevant beacon: On the Beacon Properties page, scroll down to Status and then click Reconfigure Beacon: Click the highlighted Download configuration button:
Install the beacon and then open the Beacon UI -> Parent connection screen. Click Import configuration and then select the beacon configuration file.
... View more
Labels:
Dec 12, 2018
05:11 PM
Synopsis We have enabled the option 'ShowManagementDashboardForScopedUsers' in our database to hide certain features from scoped users, but we now see a blank page after logging in.
Is there a way to change the page that a user is first presented with? Discussion There is currently no way to change this via FlexNet Manager Suite UI. However, the URL Rewrite rule in the 'Workaround' section of this KB will provide the needed functionality. Workaround The following steps are performed on the FlexNet Manager Suite Application server (which holds the 'Suite' IIS Application) , via IIS Manager. The changes are not needed on any other server.
In IIS Manager, click Default Web Site then open URL Rewrite under the IIS section. Click Add Rule(s) under the Actions pane on the right, then select Blank rule under Inbound rules. Click OK. Add a name of choosing, then specify the following parameters:
Match URL section:
Requested URL: Matches the Pattern Using: Regular Expressions Pattern: ^\/{0,1}suite\/{0,1}$ Ignore case: Checked / Selected
Conditions and Server Variables sections:
Leave blank
Action section:
Action type: Redirect Rewrite URL: /Suite/Management/Views Append query string: Checked / Selected Redirect type: Temporary (307) Save the rule and test if the rule is redirecting OK - the results should be instant. Disable the rule if there are any issues. Related KB Articles 000026149
... View more
Labels:
Dec 12, 2018
05:01 PM
2 Kudos
Summary
This article is useful for resolving errors seen during the 'usage' step of the O365 import
Symptoms
We have configured the O365 adapter, but when we try and run an import we see a failure related to the 'Usage' step. What is wrong with our set up?
Cause
This issue is related to the 'Usage.xml' step of our O365 adapter. This is a known issue caused by throttling on Microsoft's servers.
After discussing this with Microsoft's engineering team, our engineering team learned that the "LastLoginDate" for Exchange and Skype are not actually the last logon dates but rather they are the last sync dates with AD. This amounts to the last time a password was reset.
Currently, there is no way to get the usage data using Powershell, however, our engineering team is working on developing this so that the adapter can collect usage info.
Resolution
This issue was fixed with a new Microsoft 365 connector, released in FNMS 2019 R1.
Workaround
Due to the returned 'usage' not being usage but instead, a last login date - the Usage.xml part of the reader can be safely disabled as it doesn't add any value to the imports at present.
Customers seeing this issue can try resolving it by using the following workaround.
FlexNet Manager Suite Cloud (SaaS) workaround
On the beacon which is configured to collect your O365 data:
Open the ImportProcedures\Inventory\Reader folder by default at C:\ProgramData\Flexera Software\Compliance\ImportProcedures\Inventory\Reader
Copy the Microsoft Office 365 folder up two directories, and into the ObjectAdapters\Reader folder. Note: You may need to create the Reader folder inside ObjectAdapters . This would be the relative location of ..\..\ObjectAdapters\Reader from the Inventory\Reader folder location (by default: C:\ProgramData\Flexera Software\Compliance\ImportProcedures\ObjectAdapters\Reader ).
Copy the Importer.xml from the Inventory folder to ObjectAdapters .
Rename the Microsoft Office 365 to Cloud Microsoft Office 365
You should now have the following folder structure:
\---ObjectAdapters
| Importer.xml
\---Reader
|
\---Cloud Microsoft Office 365
InstallerEvidence.xml
License.xml
Logic.ps1
readerV2.config
Usage.xml
User.xml
Open the file ObjectAdapters\Reader\Cloud Microsoft Office 365\readerV2.config in a text editor.
Remove the highlighted Reader line for the Usage procedure as below:
<Readers>
<Reader FileName="User.xml" ProcedureName="Computer" />
<Reader FileName="InstallerEvidence.xml" ProcedureName="Evidence" />
<Reader FileName="License.xml" ProcedureName="LicenseCreateUpdate" />
<Reader FileName="Usage.xml" ProcedureName="Usage" />
</Readers>
The Readers section should now look like this:
<Readers>
<Reader FileName="User.xml" ProcedureName="Computer" />
<Reader FileName="InstallerEvidence.xml" ProcedureName="Evidence" />
<Reader FileName="License.xml" ProcedureName="LicenseCreateUpdate" />
</Readers>
Save the file, and create a new Powershell connection in the Beacon UI, specifying Cloud Microsoft Office 365 as the Source Type and the credentials for the Office 365 connection. Then attempt the import again. If the issue is still occurring, contact Flexera support.
FlexNet Manager Suite On-Premise workaround
This must be performed at a top level, from the Batch Server to prevent the reader from being reverted by the parent connection.
Open the file C:\ProgramData\Flexera Software\Compliance\ImportProcedures\Inventory\Reader\Microsoft Office 365\readerV2.config in a text editor.
Remove the highlighted Reader line for the Usage procedure as below:
<Readers>
<Reader FileName="User.xml" ProcedureName="Computer" />
<Reader FileName="InstallerEvidence.xml" ProcedureName="Evidence" />
<Reader FileName="License.xml" ProcedureName="LicenseCreateUpdate" />
<Reader FileName="Usage.xml" ProcedureName="Usage" />
</Readers>
The Readers section should now look like this:
<Readers>
<Reader FileName="User.xml" ProcedureName="Computer" />
<Reader FileName="InstallerEvidence.xml" ProcedureName="Evidence" />
<Reader FileName="License.xml" ProcedureName="LicenseCreateUpdate" />
</Readers>
Save the file, attempt the import again. If the issue is still occurring, contact Flexera support.
... View more
Labels:
Sep 11, 2018
02:30 PM
Symptoms
After executing the O365 import, the task successfully completes on the Beacon. However, after it has been uploaded into the FNMS server, the import into FNMS failed with the following error that can be seen in the importer log on the FNMS batch server:
2018-08-31 00:33:35,559 [INFO ] Failed to execute Writer 'Create license allocations from ImportedSoftwareLicenseAllocations' from file C:\ProgramData\Flexera Software\Compliance\ImportProcedures\Inventory\Writer\LicenseCreateUpdate.xml
Error: Violation of UNIQUE KEY constraint 'UQ_SoftwareLicenseAllocation'. Cannot insert duplicate key in object 'dbo.SoftwareLicenseAllocation_MT'. The duplicate key value is (293, <NULL>, 8391, <NULL>, <NULL>, <NULL>, <NULL>).
The statement has been terminated.
Added 0 new user allocation(s) from the source database connections.
2018-08-31 00:33:35,559 [INFO ] All retries have been attempted for Writer 'Create license allocations from ImportedSoftwareLicenseAllocations'
2018-08-31 00:33:35,559 [ERROR] System.Data.SqlClient.SqlException (0x80131904): Violation of UNIQUE KEY constraint 'UQ_SoftwareLicenseAllocation'. Cannot insert duplicate key in object 'dbo.SoftwareLicenseAllocation_MT'. The duplicate key value is (293, <NULL>, 8391, <NULL>, <NULL>, <NULL>, <NULL>).
The statement has been terminated.
Added 0 new user allocation(s) from the source database connections.
at System.Data.SqlClient.SqlConnection.OnError(SqlException exception, Boolean breakConnection, Action`1 wrapCloseInAction)
at System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj, Boolean callerHasConnectionLock, Boolean asyncClose)
at System.Data.SqlClient.TdsParser.TryRun(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj, Boolean& dataReady)
at System.Data.SqlClient.SqlCommand.RunExecuteNonQueryTds(String methodName, Boolean async, Int32 timeout, Boolean asyncWrite)
at System.Data.SqlClient.SqlCommand.InternalExecuteNonQuery(TaskCompletionSource`1 completion, String methodName, Boolean sendToPipe, Int32 timeout, Boolean& usedCache, Boolean asyncWrite, Boolean inRetry)
at System.Data.SqlClient.SqlCommand.ExecuteNonQuery()
at ManageSoft.Compliance.Importer.Logic.XML.Writer.Execute(IExecutionContext context)
at ManageSoft.Compliance.Importer.Logic.ComplianceImporter.ExecuteWriters(ComplianceReader p_ComplianceReader, IExecutionContext context, String singleConnectionIdentifier)
Cause
There is a missing DISTINCT SQL keyword for a specific DB writer procedure in LicenseCreateUpdate.xml. The below bold line shows the DISTINCT keyword in italics, this keyword is missing in the writer for version 2017 R1:
<Writer xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
Name="Create license allocations from ImportedSoftwareLicenseAllocations"
Order="1180"
Retries="1">
<![CDATA[
INSERT INTO dbo.SoftwareLicenseAllocation
(
SoftwareLicenseID,
ComplianceUserID,
NumberAllocated,
SoftwareLicenseAllocationStatusID
)
SELECT DISTINCT sl.SoftwareLicenseID,
cu.ComplianceUserID,
1,
3 -- Permanent
FROM dbo.ImportedSoftwareLicenseAllocation isla
Resolution
This is resolved in later versions of FNMS, 2017 R2 and onwards.
Workaround
For 2017 R1:
Back up the FNMS Compliance DB
Back up the current LicenseCreateUpdate.xml from the server with the "Batch Processor" services. This file by default is located in C:\ProgramData\Flexera Software\Compliance\ImportProcedures\Inventory\Writer.
Overwrite the above file with the attached XML.
... View more
Sep 10, 2018
08:10 PM
Summary How do I change a Service Account into an Interactive Account (and vice versa)? Synopsis I created a Service Account but meant to create an Interactive Account. How do I change this? Discussion Changing a Service Account into an Interactive Account (and vice versa) is currently not possible without running an SQL query.
On FNMS Cloud (both US and EU), this must be requested through support. On FNMS On-Premises, this can be remedied via the 'Workaround' available in this KB. Workaround According to the online help available via the ? icon in the top-right of the Web UI, the difference between a Service and Interactive Account is the Web Service role is assigned automatically to a Service Account. You can read this by navigating down to System Menu -> Accounts -> Creating an Account.
Creating a Service Account, it can be seen that this is assigned the Web Service role and that the Interactive column of dbo.ComplianceOperator is set to 0.
Follow these steps to change the account into an Interactive Account (and vice versa by changing the SET Interactive statement to 0):
Back up the FNMS Compliance DB , particularly the dbo.ComplianceOperator table. Change the role of the account and permissions as desired. Amend and run the following SQL command, adjusting the variable @OperatorLogin to the DOMAIN\username of the account:
DECLARE @OperatorLogin varchar(255)
SET @OperatorLogin = 'DOMAIN\username'
UPDATE dbo.ComplianceOperator
SET Interactive = 1
WHERE OperatorLogin = @OperatorLogin
Additional Information This is typically seen when a user that has been mistakenly set up as a service account tries to login and gets an access denied page with the following message:
Your account does not allow you to access FlexNet Manager Suite interactively. Please contact your administrator.
... View more
Jun 28, 2018
04:27 PM
Symptoms Server is still not reflecting in the reports and running ndtrack manually with Upload=false option does not generate any inventory data. We see the following error in the tracker.log:
[Thu Apr 12 16:36:37 2018 (G, 0)] {9303} ************************************************************
[Thu Apr 12 16:36:37 2018 (G, 0)] {9303} Program arguments are '/opt/managesoft/libexec/ndtrack -t Machine -o Upload=false'
[Thu Apr 12 16:36:37 2018 (G, 0)] {9303} Preferences loaded
[Thu Apr 12 16:36:37 2018 (G, 0)] {9303} Inventory Setting file is '/var/opt/managesoft/tracker/inventorysettings/InventorySettings.xml'
[Thu Apr 12 16:36:37 2018 (G, 0)] {9303} Obtaining semaphore lock (to ensure only one instance is running)...
[Thu Apr 12 16:36:37 2018 (G, 0)] {9303} ERROR: Could not obtain semaphore lock, Windows error code: 2
[Thu Apr 12 16:36:37 2018 (G, 0)] {9303} Program exited with code -536870910
[Thu Apr 12 16:36:37 2018 (G, 0)] {9303} ************************************************************ Cause This is usually due to the system running out of semaphores to allocate. Applications such as Oracle DB and Apache can use a lot of semaphores, and if an application has a programming issue, this can prevent them from being freed and thus prevent other applications from using them. Steps To Reproduce Reduce semaphore limits to lower than needed. Observe the error when running ndtrack Resolution There are several commands that can be used to troubleshoot this issue and find out if there are excessive semaphores in use by the system:
Show current semaphore limits:
ipcs -ls
Show current semaphore usage:
ipcs -us
Show the processes associated with current semaphores in use:
for pid in $(for semid in $(ipcs -s | awk '/0x/{ print $2 }'); do ipcs -s -i $semid | tail -2 | head -1 | awk '{print $5}'; done | sort -u); do ps uh -p $pid; done
After investigating the above you may notice that the semaphore limit is not set high enough or a process is using a lot of semaphores.
... View more
- « Previous
-
- 1
- 2
- Next »
About
Software Engineer
Latest posts by ccrawford
| Subject | Views | Posted |
|---|---|---|
| 1016 | Oct 08, 2020 06:38 AM | |
Re: What is the best way to find memory leaks in JaveScript? | 9 | Sep 01, 2020 06:46 AM |
| 1231 | Aug 26, 2020 10:57 AM | |
| 768 | Aug 14, 2020 04:04 AM | |
| 1011 | Jul 17, 2020 08:46 AM | |
| 2817 | Jul 16, 2020 01:23 PM | |
| 1346 | Jul 16, 2020 08:39 AM | |
| 840 | Jul 16, 2020 07:14 AM | |
| 1508 | Dec 16, 2019 12:16 PM | |
| 1870 | Dec 16, 2019 05:07 AM |
Activity Feed
- Got a Kudo for Re: AWS Connector - scale to 500+ accounts. Oct 08, 2020 09:05 PM
- Got a Kudo for Re: AWS Connector - scale to 500+ accounts. Oct 08, 2020 08:59 AM
- Got a Kudo for Re: AWS Connector - scale to 500+ accounts. Oct 08, 2020 08:52 AM
- Got a Kudo for Re: AWS Connector - scale to 500+ accounts. Oct 08, 2020 08:13 AM
- Posted Re: AWS Connector - scale to 500+ accounts on FlexNet Manager Forum. Oct 08, 2020 06:38 AM
- Posted Re: What is the best way to find memory leaks in JaveScript? on FlexNet Manager Forum. Sep 01, 2020 06:46 AM
- Posted ServiceNow exports failing due to incompatible TLS versions on FlexNet Manager Knowledge Base. Aug 26, 2020 10:57 AM
- Got a Kudo for Re: Beacon Monitoring tool. Aug 14, 2020 04:13 AM
- Posted Re: Beacon Monitoring tool on FlexNet Manager Forum. Aug 14, 2020 04:04 AM
- Kudoed Re: AWS EC2 connector import failing for mfranz. Jul 29, 2020 03:42 AM
- Kudoed Monthly Vulnerability Review – June 2020 for wmahmood. Jul 17, 2020 12:02 PM
- Posted Re: Error when pointing to a new FNMS Database Instance on FlexNet Manager Forum. Jul 17, 2020 08:46 AM
- Posted Re: AWS EC2 connector import failing on FlexNet Manager Forum. Jul 16, 2020 01:23 PM
- Kudoed Re: AWS EC2 connector import failing for ChrisG. Jul 16, 2020 01:15 PM
- Posted Re: Error when pointing to a new FNMS Database Instance on FlexNet Manager Forum. Jul 16, 2020 08:39 AM
- Posted How do I generate my own signed certificate for use with Beacon Monitor? on FlexNet Manager Knowledge Base. Jul 16, 2020 07:14 AM
- Posted Re: Import and Reconcile takes lot of time after upgrade Flexnet Manager Suite to 2019 R1 on FlexNet Manager Forum. Dec 16, 2019 12:16 PM
- Posted Re: Import and Reconcile takes lot of time after upgrade Flexnet Manager Suite to 2019 R1 on FlexNet Manager Forum. Dec 16, 2019 05:07 AM
- Kudoed Re: O365 connector connectivity query for mag00_75. Dec 13, 2019 11:04 AM
- Posted Re: Import and Reconcile takes lot of time after upgrade Flexnet Manager Suite to 2019 R1 on FlexNet Manager Forum. Dec 13, 2019 10:58 AM
