search cancel

Control Compliance Suite (CCS) jobs failing with error there are no ccs manager load balancers available for job execution.

book

Article ID: 212292

calendar_today

Updated On:

Products

Control Compliance Suite Standards Database Control Compliance Suite Control Compliance Suite Standards Server

Issue/Introduction

When running jobs, they are failing with the following error:

Error in submitting query job to CCS Manager: There are no CCS Manager Load Balancers available for job execution.

OR

An error occurred in Data Query activity: Blob decryption failed: System.Security.Cryptography.CryptographicException: Padding is invalid and cannot be removed.

Cause

The blob the credentials are stored in (specifically the passwords) has become corrupted.  Look in the AppServer*.log file and search for an error similar to this.

An error occurred in Data Collection activity: Error in submitting query job to CCS Manager: There are no CCS Manager Load Balancers available for job execution. ---> System.ApplicationException: Error in submitting query job to CCS Manager: There are no CCS Manager Load Balancers available for job execution. ---> Symantec.CSM.AppServer.BladeRunnerJobs.RoutingException: There are no CCS Manager Load Balancers available for job execution. ---> System.Security.Cryptography.CryptographicException: Padding is invalid and cannot be removed.

An error occurred in Data Query activity: Blob decryption failed: System.Security.Cryptography.CryptographicException: Padding is invalid and cannot be removed.

This can also happen on Command Based checks:

2022-08-13 06:51:38.487,2022-08-12 23:51:38.487,TEST1,Warning,Standards,AppserverService,4632,,61,UpdateCommandInfoForCommandChecks,,0,1,Command info not specified for the command based check - Name:'5.7 Ensure access to the su command is restricted' Version:'1.0.0' ID:'50026545-0c87-42a7-9c86-e024fd01c2fe'

2022-08-13 06:51:45.805,2022-08-12 23:51:45.805,TEST1,Error,Symantec.CSM.EncryptionManagement,AppserverService,4632,,61,RequestBlobDecryption,,0,1,"Encrypt.RequestBlobDecryption() failed : System.ApplicationException: Blob decryption failed: System.Security.Cryptography.CryptographicException: Padding is invalid and cannot be removed.

2022-08-13 06:51:45.868,2022-08-12 23:51:45.868,TEST1,Error,QueryParamsJobAttachmentManager,AppserverService,4632,,61,RequestBlobDecryption,,0,1,"Error while attaching attachment-based check query params. : System.ApplicationException: Blob decryption failed: System.Security.Cryptography.CryptographicException: Padding is invalid and cannot be removed.
2022-08-13 06:51:45.977,2022-08-12 23:51:45.977,TEST1,Error,QueryAdditionalParamManager,AppserverService,4632,,61,RequestBlobDecryption,,0,0,"Error while attaching query params to request : System.ApplicationException: Blob decryption failed: System.Security.Cryptography.CryptographicException: Padding is invalid and cannot be removed.
2022-08-13 06:51:45.977,2022-08-12 23:51:45.977,TEST1,Error,StandardsModule.Activities,AppserverService,4632,,61,RequestBlobDecryption,,0,0,"Error creating blade job definition in BladeRunnerQueryJob.GetRequestObject() : System.ApplicationException: Blob decryption failed: System.Security.Cryptography.CryptographicException: Padding is invalid and cannot be removed.
2022-08-13 06:51:45.977,2022-08-12 23:51:45.977,TEST1,Error,AppServer.BladeRunnerJobs,AppserverService,4632,,61,Route,,0,0,"Failed to submit job to DPS Load Balancer TEST1:5600 spn=CCSManager-TEST1 Exception: Blob decryption failed: System.Security.Cryptography.CryptographicException: Padding is invalid and cannot be removed.
2022-08-13 06:51:45.977,2022-08-12 23:51:45.977,TEST1,Error,AppServer.WorkFlowSvc,AppserverService,4632,,61,RequestBlobDecryption,,0,0,"Error in BladeJobService.SubmitBladeRunnerJob. : Symantec.CSM.AppServer.BladeRunnerJobs.RoutingException: There are no CCS Manager Load Balancers available for job execution. ---> System.ApplicationException: Blob decryption failed: System.Security.Cryptography.CryptographicException: Padding is invalid and cannot be removed.
2022-08-13 06:51:45.977,2022-08-12 23:51:45.977,TEST1,Error,AppServer.Activities,AppserverService,4632,,61,RequestBlobDecryption,,0,0,"Error in submitting job to blade for dataCollectionActivity with AdamID=14c5de8c-03ae-46b5-948e-c5384b563495, InstanceID=a9d6be38-b81e-48fc-9195-98c8f729c976. There are no CCS Manager Load Balancers available for job execution. : Symantec.CSM.AppServer.BladeRunnerJobs.RoutingException: There are no CCS Manager Load Balancers available for job execution. ---> System.ApplicationException: Blob decryption failed: System.Security.Cryptography.CryptographicException: Padding is invalid and cannot be removed.

Resolution

To correct this issue do the following steps for the issue with Credentials.

  1. In the CCS Console, navigate over to the Credentials workspace.
  2. Take a note of all the credentials listed and how they are configured, such as any assets for asset specific credentials.
  3. Delete ALL of the credentials listed, or this won't work. (May need to reboot the AppServer after this step)
  4. Recreate all the needed credentials.
  5. Re-run any jobs that were previously failing, they should now run without any issue.

 

To correct this issue do the following steps for the issue with Command Based Checks, for predefined standards.

  1. In the CCS Console, find the predefined standard being used, and delete it.
  2. Close the CCS Console, on the Application Server open Control Panel.
  3. Open Programs and Features/Uninstall a Program and select Symantec Control Compliance Suite 12.<version>
  4. Then select Uninstall/Change, after the content install launches select Add/Upgrade.
  5. Uncheck anything you do not want installed, make sure the previously deleted standards are selected.
  6. Go through the different windows selecting Next, until you can Install.
  7. Once finished close, and relaunch CCS Console
  8. You will now be able to use the newly installed predefined standards to run the job successfully.

In the case of a custom standard/check you will need to either copy from known good source, or manually recreate the check.

For additional details on how this can happen please refer to the following documentation.

https://techdocs.broadcom.com/us/en/symantec-security-software/information-security/control-compliance-suite/12-6-0/ccs-support-matrix-v123000389-d8e133191/ccs-application-server-pass-phrase-v122963129-d8e232226/about-passphrases-for-application-server-service-a-v122837742-d8e140855.html

Additional Information

NOTE: When modifying the Application Server Credentials, you may run into the following error.

Failed to create JobManager Secure storage intance.

If you see that error, then make sure you followed the resolution, after step 3, reboot the server.
Then go back, you will now be able to add in the credential/password to create the Secure storage.

Powered by Wolken Software