Summary Inventory Beacons running in a proxy environment require both inventory settings and MSIE configuration. Synopsis Configuration of the FlexNet Beacon software (that operates on an inventory beacon server) is normally completed by the installer or may be configured manually, as described below. Proxy support in FlexNet Beacon has the following limitations: Authenticating proxies that require a user name and password are not supported. FlexNet Beacon supports proxies with anonymous authentication. (The only time that authenticated proxies are supported is for an interactive user accessing the web interface, such as www.flexnetmanager.com/Suite , through a proxy. All services interactions require anonymous authentication.) Use of a proxy auto-configuration (PAC) script is not supported. This may require modifications to the Microsoft Internet Explorer settings on the inventory beacon, as explained in the process below. Discussion There are several possible settings affecting inventory beacon operation with proxy servers. This is because: Very large implementations may have implemented the central application server as three (or more) distinct machines, which may therefore provide separate end-points for communications from an inventory beacon. In theory, it would be possible to have separate proxy servers mediating communications with each of these distinct end-points. Some settings are made independently for either the HTTP or HTTPS protocol. In these cases, only one of the paired settings must be implemented, and the other left clear, as described in the process below. In smaller implementations that have only a single proxy server managing Internet access for an inventory beacon, it remains necessary to configure these multiple settings as described below. Place-holders explained The following process shows placeholders proxyServerURL and portNumber that must be replaced with the appropriate values for your implementation. As well, the special case [Registry] has the following default values on different systems: On 32-bit systems: HKEY_LOCAL_MACHINE\SOFTWARE\ManageSoft Corp\ManageSoft\ On 64-bit systems: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\ManageSoft Corp\ManageSoft\ If a user runs any executable manually, the necessary corresponding registry keys are created on-demand under the hive. Making Configuration changes This process must be completed on the inventory beacon. Using regedit on the inventory beacon, configure the following registry settings, based on your FNMS environment. (All the settings in this step are used for communications to the inventory server in either a multi-server on-premises implementation or a cloud implementation): For FNMS Cloud Environments: All central servers in the Flexera cloud implementation are configured for HTTPS communications. For a top-level inventory beacon accessing the central inventory server, ensure that none of these settings use the HTTP protocol. [Registry]\Common\https_proxy = https://proxyServerURL:portNumber [Registry]\Common\DownloadSettings\ReplicatorParent\Proxy = https://proxyServerURL:portNumber [Registry]\Common\UploadSettings\ReplicatorParent\Proxy = https://proxyServerURL:portNumber [Registry]\Launcher\CurrentVersion\https_proxy = http://proxyServerURL:portNumber NOTE: This is not a typographical error. The HTTPS proxy for the Launcher must be specified with the leading protocol value of http://. For FNMS On-Premises Environments: Choose one of the following settings to match the protocol configured for your inventory server (or application server for a single-server implementation) For HTTPS: [Registry]\Common\https_proxy = https://proxyServerURL:portNumber For HTTP: [Registry]\Common\http_proxy = http://proxyServerURL:portNumber Next, set the following two values, in each case using the protocol (http or https) appropriate to your environment: [Registry]\Common\DownloadSettings\ReplicatorParent\Proxy = https://proxyServerURL:portNumber [Registry]\Common\UploadSettings\ReplicatorParent\Proxy = https://proxyServerURL:portNumber Finally, choose one of the following settings to match the protocol configured for your inventory server (or application server in a single server implementation). For HTTPS: [Registry]\Launcher\CurrentVersion\https_proxy = http://proxyServerURL:portNumber For HTTP: [Registry]\Launcher\CurrentVersion\http_proxy = http://proxyServerURL:portNumber NOTE: This is not a typographical error. The HTTPS proxy for the Launcher must be specified with the leading protocol value of http://. Identify (and if necessary, create) a named account that will run batch processes on the inventory beacon. The account must have the following rights on the inventory beacon server: Local administrator rights — Required for operation of the FlexNet Beacon software Logon interactively — Required to logon and run Microsoft Internet Explorer to configure the proxy (and thereafter, this right may be removed if required) Logon as a service — Required for running the FlexNet Beacon engine as a service Logon as a batch job — Required for running scheduled tasks. You can check Microsoft Service Manager on the inventory beacon to see which account is running the FlexNet Beacon engine service. By default, the FlexNet Beacon engine is configured to run as local SYSTEM user. (If you are creating a different account, be aware that an upgrade to FlexNet Beacon may reset the account to local SYSTEM, and you may need to reset the account as part of the upgrade process.) Log in as the named account, and run Internet Explorer: (This may be optional depending on how your proxy was set up) In Internet Explorer, navigate to Tools > Internet Options. In the Internet Options dialog, select the Connections tab. Click LAN settings. In the Local Area Network (LAN) Settings dialog: Leave the default selected setting for the Automatically detect settings check box. Ensure that the Use automatic configuration script check box is cleared (this option is not supported for inventory beacon communications). In the Proxy server section, select the Use a proxy server for your LAN check box. Click Advanced, and complete the further required details in the Proxy Settings dialog. Click OK enough times to close all the dialogs. These settings in Internet Explorer are used for communications to the batch server endpoint. Only if FlexNet Beacon stalls while checking certificates on HTTPS transmissions, you may wish to add [Registry]\Common\CheckCertificateRevocation and set it to false. When transferring data between an inventory beacon and the application server using the HTTPS protocol, a web server certificate is applied to the data being transferred. When receiving web server certificates from servers, the appropriate agent checks the CA (certification authority) server to ensure that the certificates are not on the CRL (certificate revocation list). If an agent cannot check the CRL (for example, the CA server is firewalled and cannot be contacted, or a proxy server prevents access), the system can stall. To avoid this stalling, you can add the Common\CheckCertificateRevocation preference and set it to False to prevents the CRL check. NOTE: From a security perspective, it is not good practice to disable the CRL check, since this means you can no longer tell when a certificate has been revoked (which happens after the authority recognizes that a server should no longer be trusted, or when a private key is believed to be compromised). It is far preferable that you instead resolve the issues that are preventing access to the CA server for the CRL check. Configure the following to run under your chosen named account: FlexNet Beacon Engine service Upload third party inventory data scheduled task Upload Flexera logs and inventories scheduled task. Restart the FlexNet Beacon Engine service. In the web interface for FlexNet Manager Suite, navigate to Discovery & Inventory > Settings, and in the Beacon settings section, ensure that the Beacon version approved for use control is not showing Always use the latest version (currently release-number). An automatic upgrade that happens as soon as a new version of the inventory beacon is available would result in the named account used for the service and scheduled tasks described above being removed in an uncontrolled manner. When you do decide to allow an upgrade to inventory beacons, check the service and tasks noted above and restore their configurations to run using the named account. When both the proxy server and the inventory beacon have been configured as described above, communications between FlexNet Beacon and the central application server operate as normal, allowing for downloads of rules and update packages for installed FlexNet inventory agents, and uploads of gathered inventory files. Related Documents This information is partially replicated from the online help for FlexNet Manager Suite. The online help is available both in FNMS and the Documentation Center.  Note that the online help is customized for either on-premises or cloud implementation so that each type shows only the information relevant to the appropriate audience. In both cases, the relevant topic is available at FlexNet Manager Suite Help > Inventory Beacons > Inventory Beacon Reference > Configuring for Proxy Servers. Documentation Center:  https://docs.flexera.com/ FNMS Cloud Online Help: https://docs.flexera.com/fnms/EN/WebHelp/index.html#tasks/FIB-Proxies.html ... View more

Summary This article explains how to resolve the issue of error when importing ARL library. Synopsis ARL import may with the following error. ManageSoft.Compliance.Logic.Core.API.ImportRecognitionDownloadException: Failed to download the file 'http://www.managesoft.com/support/Compliance/RecognitionAfter82.cab' to 'C:\Users\dummy\AppData\Local\Temp\2\RecognitionAfter82.cab'. ---> System.Net.WebException: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel. ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure. Discussion This error occurs when one or more of upper certificates are not valid. The upper certificates are usually updated by Windows update automatically, but it may be blocked or pending for customer company's policy. In that case, customer needs to update certificate manually. Workaround 1. Please access to "https://www.managesoft.com" and open "View certificates". 2. Check all certificates under the "Certification Path" are valid. 3. If not, please download the certificate from the certification broker and apply. Related KB Articles Please refer to the following article regarding how to download the root certificates that are used to verify the signed Flexera Content library files: Digital Signature upgrade for loading Content libraries ... View more

Summary This article describes an error that may occur when configuration on a beacon for which version(s) of TLS can be used for secure communications does not match what another computer your are trying to connect to requires. Synopsis You may see the following error when trying test a connection from a beacon to an inventory source: "A connection was successfully established with the server, but then an error occurred during the login process. (provider: SSL Provider, error: 0 - The client and server cannot communicate, because they do not possess a common algorithm.)" Discussion This can happen when the server you are trying to communicate with requires a newer TLS version than the WinHTTP configuration your beacon is configured to use. Enable TLS 1.1 and/or 1.2 by creating one or both of the following keys in the Windows registry on the beacon: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client Create the following registry entries under the Client key(s) as shown in the following screenshot: REG_DWORD DisabledByDefault set to 1 REG_DWORD Enabled set to 1 Refer the following article for details of the specifications: https://technet.microsoft.com/en-us/library/dn786418 If you run into any issues after disabling the older SSL protocols (like SSL 3.0 and TLS 1.0), then try the workaround listed under the Failed to Download Beacon Policy after disabling SSL 3.0 and TLS 1.0 KB Article. ... View more

Description The InstallCognos.ps1 script fails with the following error when the service account is a member of an AD group that doesn't exist. ERROR: The Flexera Analytics install script failed: An error occurred while enumerating through a collection: An error occurred while enumerating the groups. The group could not be found.   Replication Scenario   Workaround Open InstallCognos.ps1 in a text editor  Search for the string "Test-LocalAdministrator"  Comment out the following lines of code like so:  #if ($serviceUser -ne $null -and -not (Test-LocalAdministrator $serviceUser)) {  # throw "The specified service user, $serviceUser must exist and be a member of the local administrators group. The user's domain must also exist and be contactable.";  #}  Execute InstallCognos.ps1 again Version Fix Target   Resolution This issue is being tracked under  IOJ-1913873. ... View more

Symptoms: Users may see the following error when trying to edit reports with Firefox:     Diagnosis: This error is caused by a default setting of Firefox, as reported by the following KB article published by IBM:   https://www.ibm.com/support/pages/report-authoring-does-not-open-using-firefox-68  Solution: 1) Open Firefox and navigate to the configuration page by inputting "about:config" in the URL field 2) Search the "dom.link.disabled_attribute.enabled" setting 3) Set the "dom.link.disabled_attribute.enabled" setting to "false"   ... View more

Summary Customers may not see inventories from the VMs on AWS on the "All Inventory" page when AWS import is not used. Symptom This issue shows the following symptoms: 1) Inventories from the VMs on AWS come into the ImportedComputer table, but not into ComplianceComputer table. Therefore, the inventories don't appear on the "All Inventory" page. 2)  The "IsTerminated" column has "1" in the ImportedMissingComputer table for the ComplianceComputerIDs which inventory records are missing. 3) The VMEnabledStateID shows "NULL" in the ImportedCloudServiceInstance table and it is not consistent with 2). How to apply the patch Fix patches are available for the following version: For FlexNet Manager Suite 2019 R1: "2019R1.zip" For FlexNet Manager Suite 2019 R1: "2019R2.zip"   There are 4 files in the .zip file. 1) DotNet\bin\ManageSoft.Compliance.Importer.Procedures.ManageSoft.dll 2) Procedures\Reader\Amazon Web Services\Instance.xml 3) Procedures\Writer\CloudServiceInstance.xml 4) update.sql On the batch server: - Replace 1) with C:\Program Files (x86)\Flexera Software\FlexNet Manager Platform\DotNet\bin\ManageSoft.Compliance.Importer.Procedures.ManageSoft.dll - Replace 2) with C:\ProgramData\Flexera Software\Compliance\ImportProcedures\Inventory\Reader\Amazon Web Services\Instance.xml - Replace 3) with C:\ProgramData\Flexera Software\Compliance\ImportProcedures\Inventory\Writer\CloudServiceInstance.xml - Execute update.sql to update UpdateImportedCloudServiceInstanceTable stored procedure Once applied, affected computers will be changed to active after FNMS receives the latest inventory file (.ndi) and inventory import runs successfully Resolution This issue ( IOJ-2113036)  was permanently fixed in FlexNet Manager Suite 2020 R1.      ... View more

Description The queries used to determine active users from Oracle EBS are not taking expired responsibility into account and users bound to the expired responsibility consume the license. Replication Scenario Please check if there are expired responsibilities on the Oracle EBS. Workaround Please remove expired responsibility from the EBS system. Alternatively, it is possible to manually override/exempt the consumption to account for this. Version Fix Target Not determined yet.  This issue is being tracked under IOJ-2093927. Resolution   ... View more

Description * This issue impacts on  Managed Service Provider where multiple tenants are running. After an FNMS license is updated, end-users see "Sign In Failure" when logging in to MSP (ManagedServiceProvider) where SSO (SingleSignOn) is enabled. The issue is caused because the "TenantDomain" value in the "GroupTenant" table in the "FNMSBroker" database is cleared when the license is updated. Replication Scenario 1) Update FNMS license for one of the tenants. 2) Try to login to the tenant. Workaround To fix the issue, please update the value with the following query: update GroupTenant set TenantDomain = 'domain' where TenantUID = '<Tenant UID for the target tenant>' Version Fix Target Not available yet.  This product deftct is being tracked under  IOJ-2098071. Resolution   ... View more

Symptoms: Customers may see the following error when running a custom business adapter. 20-02-2020 10:17:10 - Debug - insert into [dbo].[ECMImportLog_Detail] ([ImportID], [ImportObjectID], [RecordNumber], [Action], [RecordDescription], [MGSRecordKey]) select 33851,75990, ROWNumber,'Updated',PurchaseOrderNo ,convert(varchar,PurchaseOrder_OutID) from customCancelledPurchaseOrders where updated=1 20-02-2020 10:17:10 - Error - Arithmetic overflow error converting IDENTITY to data type int. Arithmetic overflow occurred. 20-02-2020 10:17:10 - Debug - at System.Data.SqlClient.SqlConnection.OnError(SqlException exception, Boolean breakConnection, Action`1 wrapCloseInAction) at System.Data.SqlClient.SqlInternalConnection.OnError(SqlException exception, Boolean breakConnection, Action`1 wrapCloseInAction) at System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj, Boolean callerHasConnectionLock, Boolean asyncClose) at System.Data.SqlClient.TdsParser.TryRun(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj, Boolean& dataReady) at System.Data.SqlClient.SqlCommand.RunExecuteNonQueryTds(String methodName, Boolean async, Int32 timeout, Boolean asyncWrite) at System.Data.SqlClient.SqlCommand.InternalExecuteNonQuery(TaskCompletionSource`1 completion, String methodName, Boolean sendToPipe, Int32 timeout, Boolean& usedCache, Diagnosis: The error can happen when the IDENTITY is larger than the maximum value of INT which is 2147483647 when inserting into the log table. Solution: Run the following command on the FNMSCompliance database. DBCC CHECKIDENT('dbo.BusinessImportLogDetail_MT', RESEED, -2147483647)   ... View more

Symptoms: ARL import (mgsimportrecognition.exe) may fail with the following error: The client and server cannot communicate, because they do not possess a common algorithm Diagnosis: Several versions of .NET framework need additional treatments in the Windows registry when TLS 1.0 is disabled according to the following article. https://docs.microsoft.com/en-us/dotnet/framework/network-programming/tls#systemdefaulttlsversions Solution: 1. Open regedit.exe as an Administrator. 2. Change or create values as follows: [HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v2.0.50727] "SystemDefaultTlsVersions"=dword:00000001 "SchUseStrongCrypto"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319] "SystemDefaultTlsVersions"=dword:00000001 "SchUseStrongCrypto"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727] "SystemDefaultTlsVersions"=dword:00000001 "SchUseStrongCrypto"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319] "SystemDefaultTlsVersions"=dword:00000001 "SchUseStrongCrypto"=dword:00000001   ... View more

Summary Compliance import from ADDM fails with the error of "The staging state of the source ADDM staging database is currently set to "failed". It needs a patch to be fixed. Symptoms 2014-10-21 09:45:29.20: Importing from 'ADDM' [type: ADDM] 2014-10-21 09:45:29.25: FATAL: The import process has failed with the following error (use -verbose to see error details): Error: ERROR: The staging state of the source ADDM staging database is currently set to "failed". This indicates one of the following: the staging state has not been set ("unknown"), the staging process has started and not completed ("running") or staging has failed ("failed"). The staging state value must be "success" if staging was successful. Please review the output of the ADDM staging tool. There is a possible connection type mismatch: check that the database is of the correct connection type ERROR: The staging state of the source ADDM staging database is currently set to "failed". This indicates one of the following: the staging state has not been set ("unknown"), the staging process has started and not completed ("running") or staging has failed ("failed"). The staging state value must be "success" if staging was successful. Please review the output of the ADDM staging tool. 2014-10-21 09:45:29.25: Error Details: ManageSoft.Compliance.Importer.Logic.ComplianceReaderFatalException at ManageSoft.Compliance.Importer.Logic.ComplianceImporter.CalculateVersion(ReaderConfig sourceDataType, SourceConnection sourceConn) at ManageSoft.Compliance.Importer.Logic.ComplianceImporter.ExecuteReaders(ComplianceReader p_ComplianceReader, IExecutionContext context) at ManageSoft.Compliance.Importer.Logic.ComplianceImporter.ExecuteComplianceReader(ComplianceReader p_ComplianceReader, Tenant tenant) at ManageSoft.Compliance.Importer.Logic.ComplianceImporter.RunImport() 2014-10-21 09:45:29.26: 2014-10-21 09:45:29.26: Time: Tuesday, 21 October 2014 9:45:29 AM 2014-10-21 09:45:29.26: Total import time: 0 seconds 2014-10-21 09:45:29.26: 2014-10-21 09:45:29.26: 0 source data warnings 2014-10-21 09:45:29.26: 2014-10-21 09:45:29.26: 0 errors, 0 warnings 2014-10-21 09:45:29.26: 1 fatal errors. Imports may be incomplete or failed. Cause There is a bug in "FnmpADDMSettings.xml" and it should be replaced with the attached "FnmpADDMSettings_fixed.xml". Resolution Warning: Do not apply this fix to FlexNet Manager Suite 2015 R2 or above. 1) Replace "FnmpADDMSettings.xml" with the attached "FnmpADDMSettings_fixed.xml" 2) Add connection strings to be suitable for the customer's environment. ... View more

Summary This article describes a known issue that obsolete oracle instances may not be automatically cleaned in FNMSInvenotry database. Symptoms ServiceProviderApplicationUserOracle table keeps growing and the size doesn't shrink with the database maintenance task. Cause The ServiceProviderDeleteStalePerTenant procedure which is run during the IM data maintenance task doesn't cater for devices where duplicate inventory records have been created. Since this procedure relies on an updated HWDate or ServicesDate in the InventoryReport table, if a new computer record is created these will not be updated and the instance will never be deleted. The devices often end up being merged together by the matchers during the reconcile. This can result in incorrect Oracle option usage and also leftover instances which have actually been uninstalled. Resolution This issue is fixed in FNMS 2019 R1. ... View more

Summary This article answers the question. Synopsis Please take a look at the online help for more detailed information. ... View more

Summary This article answers the question in the tile. Synopsis Please take a look at the online help for the detailed explanation. ... View more