Unclear update process of appliance.

[YakovShipilov]

Hi, i have issues with update process, i can't figure out what i'm doing wrong, i try all described methods in documentation. I can't achieve state where all appliances will check for updates on SA, and will be able to install it from SA.

Here is on the picture i can see that appliances does not check is there updates available, is there work around how to fix this?

I check repos configuration, hosts, network etc, all configured as in documentation.

The path of update from 10.4.0 to 10.4.0.2 and to 10.4.1.1.

[JonathanSaxon]

Please compare the /etc/yum.repos.d/*.repo files from one of your functional hosts and one of your non-functional hosts and see if there are any differences. 

Also, please check the /etc/yum.repos.d on the SA Server as well.  The rsa.repo file should point to itself.  The sa.repo should point to the smcupdate.emc.com/nw10/rpm remote repository. 

Also, make sure your /etc/hosts or dns are functioning properly and all hosts can resolve by fqdn. 

Let me know if you have other questions and consider opening a support ticket so we can focus on your configuration questions.

Email: nwsuport@rsa.com

Phone: 800.995.5095, option 3

[YakovShipilov]

Sorry for delay with answer, rebuilding my lab, with the same result

A more deeper explanation.

Summary of the problem is that RSA SA can’t provide updates to Devices. If i go to RSA SA > Administration > Appliances there is no button Up-to-date/Update for devices i add.

I try to rebuild lab many times, and can’t figure out whats wrong.

My last steps was:

1. Deploy RSA SA from OVF to ESXi;
2. Configure IP, Hostname, add Hosts records regarding to RSA SA and RSACON and edit network in /etc/sysconfig;
3. Synchronise repository with CMS using Live;
4. Update SA with Update button in Appliances view
5. Deploy Concentrator (RSACON) from OVF to ESXi and configure ip, hostname etc reboot;
6. After reboot enter IP of RSA SA server;
7. On RSA SA i go to Appliances and click Discover, found new Device - Enable it.

And now i have RSA SA updated to 10.4.1 and RSA Concentrator stayed on version deployed from OVF.

In Logs on SA i can see this strange records, i check RSA KB, no information regarding this records.

[root@RSASA ~]# tailf /var/log/messages

Jun 10 12:04:15 RSASA collectd[2493]: GenericJMXConfConnection: Creating MBean server connection failed: java.io.IOException: Failed to retrieve RMIServer stub: javax.naming.ServiceUnavailableException [Root exception is java.rmi.ConnectException: Connection refused to host: localhost; nested exception is: #012#011java.net.ConnectException: Connection refused]

Jun 10 12:04:15 RSASA collectd[2493]: GenericJMXConfConnection: Creating MBean server connection failed: java.io.IOException: Failed to retrieve RMIServer stub: javax.naming.ServiceUnavailableException [Root exception is java.rmi.ConnectException: Connection refused to host: localhost; nested exception is: #012#011java.net.ConnectException: Connection refused]

Jun 10 12:04:49 RSASA puppet-agent[2717]: (/Stage[main]/Yumconfig/File[rsa.repo]/content) content changed '{md5}9e4077295708b271ab0af0b54349e77f' to '{md5}44b3ed096495de00ac06da048ab19049'

Jun 10 12:04:54 RSASA puppet-agent[2717]: (/Stage[main]/Yumconfig/Exec[disable-Centos-Repos]/returns) executed successfully

Jun 10 12:05:03 RSASA ntpd[2055]: 0.0.0.0 c61c 0c clock_step +0.712762 s

Jun 10 12:05:03 RSASA ntpd[2055]: 0.0.0.0 c614 04 freq_mode

Jun 10 12:05:04 RSASA ntpd[2055]: 0.0.0.0 c618 08 no_sys_peer

Jun 10 12:05:10 RSASA puppet-agent[2717]: Finished catalog run in 74.44 seconds

Jun 10 12:05:15 RSASA collectd[2493]: GenericJMXConfConnection: Creating MBean server connection failed: java.io.IOException: Failed to retrieve RMIServer stub: javax.naming.ServiceUnavailableException [Root exception is java.rmi.ConnectException: Connection refused to host: localhost; nested exception is: #012#011java.net.ConnectException: Connection refused]

Jun 10 12:05:16 RSASA collectd[2493]: GenericJMXConfConnection: Creating MBean server connection failed: java.io.IOException: Failed to retrieve RMIServer stub: javax.naming.ServiceUnavailableException [Root exception is java.rmi.ConnectException: Connection refused to host: localhost; nested exception is: #012#011java.net.ConnectException: Connection refused]

Jun 10 12:06:08 RSASA nw[2697]: [Network] [info] Accepting connection from trusted peer 127.0.0.1 with subject name CN = 6ce79c58-c079-4559-a1bf-321070600e34

Jun 10 12:06:08 RSASA nw[2697]: [Engine] [audit] User escalateduser (session 651, 127.0.0.1:51958) has logged in

Jun 10 12:06:09 RSASA nw[2697]: [Network] [info] Accepting connection from trusted peer 127.0.0.1 with subject name CN = 6ce79c58-c079-4559-a1bf-321070600e34

Jun 10 12:06:09 RSASA nw[2697]: [Engine] [audit] User escalateduser (session 676, 127.0.0.1:51960) has logged in

Jun 10 12:07:08 RSASA nw[2697]: [Engine] [audit] User escalateduser (session 651, 127.0.0.1:51958) has logged out

Jun 10 12:13:04 RSASA python: update-federation-links.py: No changes needed.

Jun 10 12:20:44 RSASA ntpd[2055]: 0.0.0.0 c612 02 freq_set kernel 6.246 PPM

Jun 10 12:20:44 RSASA ntpd[2055]: 0.0.0.0 c615 05 clock_sync

Catalogs are identical (/etc/yum.repos.d/*.)

On RSA SA rsa.repo points to ip belongs to RSA SA, and sa.repo point to smcupdate:

[root@RSASA ~]# cat /etc/yum.repos.d/rsa.repo

[RSASoftware]

name=RSA Software Updates Repo

baseurl=http://10.31.103.130/rsa/updates/

## TODO enable once this is fixed

enabled=1

gpgcheck=0

sslverify=1

sslcacert=/etc/pki/CA/certs/RSACorpCAv2.pem

[root@RSASA ~]# cat /etc/yum.repos.d/sa.repo

[sa]

name=SA Yum Repo

baseurl = http://smcupdate.emc.com/nw10/rpm

enabled = 1

protect = 0

gpgcheck = 1

sslVerify = 1

sslcacert = /etc/pki/CA/certs/RSACorpCAv2.pem

metadata_expire = 1d

failovermethod=priority

proxy = http://10.10.10.10:2270

/etc/hosts i add here records for RSA SA and RSA CON vice versa, no DNS configured (don't have in lab).

I opened case, hope we can resolve this issue.

[JonathanSaxon]

Try to run an "mco ping" from the SA Server.  It should report all the UIDs that it can communicate with.  Make sure the new Concentrator is listed in the response.

The collectd message only applies to the Health & Wellness portion of SA so it shouldn't have anything to do with upgrades directly. 

Please send your case number so I can review and discuss with the engineer who is working your case.  We can test this in our lab pretty quickly to see if we can reproduce. 

[YakovShipilov]

I don't know where i can check this UID to make sure it listed here.

[root@RSASA ~]# mco ping

9d3fdcf2-5f36-4062-93ed-6da3de0f55cd     time=36.69 ms

6ce79c58-c079-4559-a1bf-321070600e34     time=39.08 ms

---- ping statistics ----

2 replies max: 39.08 min: 36.69 avg: 37.88

Case Number 00697646