Has FNMS been tested on: 1:XMl exploide 2:Buffer over run exploid based on an NDI  3: Is there an pentest report availlable? Also why is there no secure authentication possible from the agents towards the beacon when they upload their NDI?  Are there plans to make this more secure? Altough basic authentication is possible it is not secure.  With a beacon on the internet (DMZ) there is an potential risk in having an indirect opening towards the Application and SQL server. From their information around what software is installed can be collected from all servers. What is very usefull information from hacking. What are the current plans to make the agent to BEacon communications more secure?  ... View more

Summary: After upgrading from version x to a newer version. You might choose to upgrade your beacon or agent manually. Once this has been done, there is a chance, or you noticed that the agent or beacon downgrade from the most recent version to an older version. There are multiple scenarios this might be happening: Beacons are set to stay at that level through automatic deployment Unable to select the most recent version to deploy Scenario 1 Within Discovery & inventory > Settings Agents Under Inventory Agent for Automatic Deployment         Beacons Beacons have two places that control what version they are running: 1. Discovery & Inventory > Settings> Beacon Settings 2. Discovery & Inventory > Beacons If you press the edit button next to the beacon in question   These drop downs are controlled by your adoption table within your database, if these are not showing the most recent version then this will be why your beacons and agents are downgrading. If this is the case, then move over to scenario 2.   Scenario 2 This scenario follows on from scenario 1, when the options that you can select does not include the most recent update. The problem stems from the adoption table not having the most recent version stored within it. This usually is caused by either the config.ps1 not being ran or not completed fully. To rectify this issue. Re-run the config.ps1 and allow it complete. If you notice any errors check where it errored out. ... View more

Summary This KB article will cover the configuration and collection of trace files within FNMS. For additional logging of what is being collected during the inventory, It will cover the different types of trace files including details on lite agents.   Synopsis Trace level logging can be performed on the batch, application, beacon, and agent and is used primarily when the normal logging solutions do not provide enough information, even with debug settings enabled. By generating a trace log you can track much more activity although tracking everything can result in very large files so be warned to only use this when necessary and do not forget to turn it off when you're done.   Trace file location per component The location of the trace files is dependent on what you are looking to trace. Each component has a different location, see the below table for reference Component File Name Windows File Location Linux File Location Full Agent ETCP.trace C:\Program Files (x86)\ManageSoft /opt/managesoft Lite Agent (remote execution) ndtrack.trace Wherever the ndtrack.exe is located (i.e. C:\Temp\) root /etc  Beacon ETDP.Trace C:\Program Files (x86)\Flexera Software\Inventory Beacon N/a Inventory/Batch ETAP.trace C:\Program Files (x86)\Flexera Software\FlexNet Manager Platform N/A Note: that the Lite Agent (remote execution) trace file should be called ndtrack.trace   How to run the trace files Go to the component that you want to run a trace on (see Trace file location per component) Navigate to the directory (see Trace File location per component) Take a backup copy if you require to revert back to the original Open the relevant Trace file (be aware you may need to first disable the relevant Flexera service via services.msc before this file can be opened or saved) Once opened find the following line and define a valid file-path (Please note the location must exist otherwise the trace will not work)   Usually, the technical support member will inform you of what you will need to uncomment, to do so remove the ‘#’ from the beginning of the line   Once done, save the document and attempt to perform the problem action again, i.e. Agents run the following commands For Windows Agents and Lite Agents: ndtrack.exe -t Machine -o LogFile=C:\Temp\tracker.log -o Upload=false -o MachineInventoryDirectory=C:\Temp For non-Windows Agents: ./ndtrack -t Machine -o LogFile=/tmp/log/managesoft/tracker.log -o Upload=false -o MachineInventoryDirectory=/tmp/log/managesoft For non-Windows Lite Agents: ./ndtrack.sh -t Machine -o LogFile=/tmp/log/managesoft/tracker.log -o Upload=false -o MachineInventoryDirectory=/tmp/log/managesoft Beacons execute a discovery rule or scheduled task etc. Batch execute a license or full reconcile, one-off import, etc. Note: It might be quite large prior to compressing, and might take a while to generate the relevant files Navigate to the location set within the trace.log file The directory should include Managesoft_#_Date.log (if kept default file name) Compress the files and attach to the case if needed Note: remember to repeat steps 1 - 6 and to comment the code out using '#' or to restore to your backed-up copy.   References Options Definitions (ETCP) For the full guide see “Adopted: Troubleshooting Inventory” within the GatheringFlexnetInventory.pdf Category Option Notes Networking +Communication/Network Traces all low-level upload and download actions (whether HTTP or HTTPS). It includes HTTPS certificate checking and related areas. Covers actions by the ndtrack, ndupload, and ndlaunch components. All inventory +Inventory Traces all inventory operations, which on large inventory tasks, could result in a sizable trace file. All tracker +Inventory/Tracker This traces almost all operations of the ndtrack executable. Preferences +Inventory/Tracker/ Environment Shows active preferences, whether set in the registry (on Windows platforms) or in the config.ini file (on UNIXlike platforms), or inbuilt default values. Hardware inventory +Inventory/Tracker/Hardware Traces all hardware inventory classes visible in the <Hardware> node in the .ndi inventory file, including CPU information and virtualization. Software inventory +Inventory/Tracker/Package Traces the inventory operations that populate the <Package> nodes in the .ndi inventory file. Software inventory +Inventory/Tracker/Software Tracing mainly for file inventory gathering (such as the <Content> and MD5 nodes of the .ndi file). Oracle inventory +Inventory/Tracker/Oracle When the inventory device hosts Oracle Database, this is the tracing for local Oracle inventory. Operations +Inventory/Tracker/Generate Traces the preparation of the .ndi inventory file(s), keeping in mind that on an Oracle Database server, there may be multiple files generated. Operations +Inventory/Tracker/Compress Traces the compression of the .ndi file into a .gz archive. Operations +Inventory/Tracker/Upload Traces the upload of the .ndi.gz archive to an inventory beacon by the tracker. Tip: If the immediate upload by the tracker fails for some temporary reason, the upload is attempted again later by the ndupload component. While this component does not provide this same level of operations tracing as the tracker does, you can enable +Communication/ Network for low-level tracing of each step in the upload interaction.     ... View more

  Synopsis  This article assumes that you have already stood up a server with SQL server, and have moved the database to that server. This article will cover the re-connection from your old connection settings to the new instance. Resolution There are a few ways in which you can connect to your new instance. 1) Rerunning the Config.ps1 script  This is by far the most effective way as this will change all settings. however, this does rely on having the FNMS installation files. This will also need to be ran on the batch, application, and Inventory Server. If you are running a single server setup then you just need to run it on the one box.  a) Open Installer folder location>Support b) Press File> Open in PowerShell admin c) run the following command .\Config.ps1 "Config\FNMS Windows Authentication Config.xml" forceUpdateConfig The first page that you get will be the database settings, simply update the fields of your server and instance, after that, you will need to continue through the full process.  2)Alter the Registry These changes will also need to be run on the batch, application, and Inventory Server. If you are running a single server setup then you just need to run it on the one box.  a) Open Regedit  b) Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\ManageSoft Corp\ManageSoft\Reporter\CurrentVersion c) Change the following keys server to the servername of where your database server is  i) DatabaseConnectionString = Driver={SQL Server};Server=ServerName;Database=FNMSCompliance;Trusted_Connection=yes; ii) FNMPDWDatabaseConnectionString = Driver={SQL Server};Server=ServerName;Database=FNMSDataWarehouse;Trusted_Connection=yes; iii) InventoryDatabaseConnectionString = Driver={SQL Server};Server=ServerName;Database=FNMSInventory;Trusted_Connection=yes; iiii)SnapshotDatabaseConnectionString = Driver={SQL Server};Server=ServerName;Database=FNMSSnapshot;Trusted_Connection=yes; Additionally, after performing one of the two options above, the Compliance database would also need to be updated to point to the new server. The Server column for the FNMPDataWarehouse and FlexNet Manager Suite connections in the ComplianceConnection table needs to be updated with the new server. This can be done with a query like so (replace YourServerHere with your new server name ) update ComplianceConnection set Server = 'YourServerHere' where ConnectionName in ('FNMPDataWarehouse', 'FlexNet Manager Suite') Finally, it is recommended to restart the IIS server/iisreset to clear the IIS cache and ensure that all the changes above are reflected. ... View more

Symptoms: If you have just recently relicensed your server and are unable to get the login screen within FNMEA such as the below screenshot could be caused by a number of things.              In this instance, the service is not running and cannot be started as it keeps shutting down.        Diagnosis: Check within the admin logs located by default <install Directory> Manager/ Admin/ Logs/ Within the server log you might see the following  2020-02-05 13:10:45,076 INFO [stdout] (MSC service thread 1-12) The server is not properly licensed: Invalid license specifications: 2020-02-05 13:10:45,076 INFO [stdout] (MSC service thread 1-12) 3 2020-02-05 13:10:45,076 INFO [stdout] (MSC service thread 1-12) 2020-02-05 13:10:45,076 INFO [stdout] (MSC service thread 1-12) Server is shutting down.   Solution: First Check how many increment lines you have, there should be 20 by default. If there are more it is highely likely that you have older versions within the license file. So simply remove the duplicate older versions of the lines.  Secondly check to see your servername. This is case sensitive, so what ever it says within your system page Control Panel>System> Computer Name  If is SeRverName01 the license file needs to be the same, it cannot be servername01 it has to match the case. ... View more

Symptom When loading the Beacon Interface you might be presented with the following: There are a few things that could be causing this   Issue 1: The license file has not been imported into FNMS Workaround: First you will need to make sure you have a valid license. This can be obtained from within your Product and License Center Portal. On your batch server, launch the Flexnet Manager Suite Activation Wizard (Start> Flexera Software> Flexnet Manager Suite Activation Wizard) Press import License and import your license. that should resolve your beacon issue. It might be a good idea to restart the beacon engine service from within services manager   Issue 2: Check your beaconengine.log for the following 2020-05-18 00:00:55,133 [Services.PolicyService|policy] [ERROR] Failed to download policy. ManageSoft.Compliance.ComplianceException: Verification failed: No Signature was found in the document. ---> System.Security.Cryptography.CryptographicException: Error occurred during a cryptographic operation. --- End of inner exception stack trace --- at ManageSoft.Compliance.Security.Cryptography.DigitalSigner.VerifyXml(XmlDocument Doc, RSA Key) at ManageSoft.Compliance.Security.Cryptography.DigitalSigner.VerifyXml(XmlDocument xmlDoc) at Flexera.SaaS.Transport.Rules.PolicyClient.VerifyPolicySignature(MemoryStream ms) at Flexera.SaaS.Transport.Rules.PolicyClient.DownloadPolicy(String currentVersion, String inventorySettingsRevision) at Flexera.Beacon.Engine.Services.PolicyService.GetPolicyFromServer(Int32 currentRevisionNumber, String inventorySettingsRevision) at Flexera.Beacon.Engine.Services.PolicyService.UpdatePolicy(IActivityLogger activityLogger) 2020-05-18 00:00:55,133 [llers.PolicyController|policy] [ERROR] There is a problem on the beacon. The beacon could not determine if an upgrade is required. Work Around: There is currently a bug located FNMS-64113 This is caused by a registry key that was mistakenly included in the installer Open Registry Edit (regedit) Navigate to HLKM\SOFTWARE\Wow6432Node\ManageSoft Corp\ManageSoft\Compliance\CurrentVersion\ Remove the key certificatefile Restart the beacon engine service ... View more