9 Replies Latest reply: Feb 23, 2012 4:00 AM by Frank Wils RSS

    How To Troubleshoot Patches That Fail

    RWilk Rookie

      I'm going to post a discussion I have a feeling has been asked before.  Its common for me to push out a patch (in this case Adobe Flash, but it happens with Microsoft updates) and a relatively small subet of computers (~5%) show up as failed.  I look at the logs in the Management console and it gives no detail on why it failed.

       

      Here is a screenshot of a list of machine that failed (either all patches or some).

       

      And here is the logs from the Management console from one of the machines.  I'm stuck on how to troubleshoot this.  Of course I replaced my server name with (core server).  In this case I'm patching the latest Adobe Flash updates: FLASHPLAYERPLUGINv11.1.102.62 and FLASHPLAYERv11.1.102.62.

       

      Verifying device ID with core (core server)
           Done
      Updating settings
           Done
      Sending current settings information to core
           Done
      Getting list of patches
           Done.  2 patches were found
      Downloading http://(core server)/LDLogon/patch/install_flash_player_32bit_11.1.102.62.exe
      Downloading file from source http://(core server)/LDLogon/patch/install_flash_player_32bit_11.1.102.62.exe.
      Downloading file from source http://(core server)/LDLogon/patch/install_flash_player_32bit_11.1.102.62.exe.
      Downloading file from source http://(core server)/LDLogon/patch/install_flash_player_32bit_11.1.102.62.exe.
      Downloading file from peer http://(core server)/LDLogon/patch/install_flash_player_32bit_11.1.102.62.exe (10.170.7.34).
           Done
      Downloading http://(core server)/LDLogon/patch/install_flash_player_ax_32bit_11.1.102.62.exe
      Downloading file from source http://(core server)/LDLogon/patch/install_flash_player_ax_32bit_11.1.102.62.exe.
      Downloading file from source http://(core server)/LDLogon/patch/install_flash_player_ax_32bit_11.1.102.62.exe.
      Downloading file from source http://(core server)/LDLogon/patch/install_flash_player_ax_32bit_11.1.102.62.exe.
      Downloading file from peer http://(core server)/LDLogon/patch/install_flash_player_ax_32bit_11.1.102.62.exe (10.170.7.34).
           Done
      Running patch install_flash_player_32bit_11.1.102.62.exe
      Installing patch 1 out of 2 patches
           Failed
           Done
      Running patch install_flash_player_ax_32bit_11.1.102.62.exe
      Installing patch 2 out of 2 patches
           Done
           Done
      Getting definition data from core (core server)
           Done
      Current Definition ID: FLASHPLAYERPLUGINv11.1.102.62
      FLASHPLAYERPLUGINv11.1.102.62 detected
      Current Definition ID: FLASHPLAYERPLUGINv10.3.183.11
      Current Definition ID: FLASHPLAYERPLUGINv11.1.102.55
      Current Definition ID: FLASHPLAYERv11.1.102.62
      Current Definition ID: FLASHPLAYERv10.3.183.11
      Current Definition ID: FLASHPLAYERv11.1.102.55
           Done
      Sending scan results to core (core server)
           Done

        • 1. Re: How To Troubleshoot Patches That Fail
          RWilk Rookie

          So the screenshot didn't take.  Here it is.

           

          Capture.GIF

          • 2. Re: How To Troubleshoot Patches That Fail
            Bradley_M Apprentice

            Since your failure rate is less than %5 my initial guess is that these people might be actively using the flashplayer at the time.  Therefore it can't update Flash Player because it is active.  Similarly I have a lot of trouble using LANDesk to natively repair Java from what I guess is that Java really likes IE closed when this is done.

             

            If you try the patches against your failures again do you pick additional successful ones or are they continually failed over and over?

            • 3. Re: How To Troubleshoot Patches That Fail
              RWilk Rookie

              I'm rerunning the task now to see if it will pick them up.  I guess my question is more so when a task simply comes up 'Failed', there is no explanation on why it happened.  Maybe the laptop users powered off or hibernated during install.  Maybe something got corrupt with the transfer of the file to the client.  It would be more useful if we had something like "Failed - File Locked" or "Failed - Bad CRC Check" or "Failed - Installation was interrupted', or something more useful.  Does that information exist anywhere?

              • 4. Re: How To Troubleshoot Patches That Fail
                Frank Wils SSMMVPGroup

                Look at the vulscan logfiles on the client in %ALLUSERSPROFILE%\ Application Data\Vulscan

                 

                Frank

                Axle-IT

                • 5. Re: How To Troubleshoot Patches That Fail
                  RWilk Rookie

                  I knew the answer was simple.  When I looked at that log, I noticed the following error.  I'll update our internal documentation so we know how to troubleshoot this.  Thanks!

                   

                   

                   

                  Command Interpreter running
                  FMode: 0
                  Force Mode = No
                  Message returned from repair script was The firefox browser is running, please close the browser before installing the patch.
                  ERROR(RunVbScript) Failed to run command  - 80004005
                  DownloadPatch ERROR: Failed to run commands (80004005).
                  Last status: Failed
                  In SendRequest: Action = SOAPAction: "http://tempuri.org/SetPatchInstallStatus"

                  • 6. Re: How To Troubleshoot Patches That Fail
                    Rookie

                    RWilk,

                     

                     

                    you can use the Xtrace on client if you want to go in details also you can go to Run  and type vulscan e  it will directly take you to the vulscan log file.

                     

                     

                     

                     

                    Regards

                     

                    • 7. Re: How To Troubleshoot Patches That Fail
                      Bradley_M Apprentice

                      I didn't know this option was in there but supposedly you can have the patch force Firefox, IE, and other things closed if you change the force mode on the patch.  I have never tried this on a patch before.  Has anybody tried?

                      • 8. Re: How To Troubleshoot Patches That Fail
                        mrspike SSMMVPGroup

                        If you are willing to force close the browsers without any warning, you can go into the patch and there is a "custom variables" tab at the top and you can set this to "yes", thsi will force the browsers to close.

                         

                        You could clone the original patch and have one that will force close, and leave the orignal as is.... I do this, and advise our patching flks that they should only use the force close version at night and only after a few attempts have been made the other way

                        • 9. Re: How To Troubleshoot Patches That Fail
                          Frank Wils SSMMVPGroup

                          Glad you found it! Can you please mark it as answered to be helpful to others and give Bradley his credit for his correct answer?

                           

                          Franj