Control Compliance Suite - Agent Product Update - "Failed to start the remote update process on agent."
Article ID: 217945
Updated On:
Products
Issue/Introduction
Running an APU job against 12.5 or 12.5.1 agents to upgrade them to a newer version and you get the following error.
Failed to start the remote update process on agent.
Update Details:
Verifying signature of the package files... Done
Done
Connecting to agent server on the agent... Stopping all jobs on the agent before beginning update operation...Done
Closing connection with the agent update server... Done
Opening connection with the agent... Done
Connecting to update server on the agent... Done
Checking if manager is installed on the agent... Done
Checking if agent is running any other updates... Done
Checking for free space on agent... Done
Stopping the update support service if it is running on the agent... Done
Attempt no. 1 : Upload and run the support service on the agent...
Attempt no. 2 : Upload and run the support service on the agent...
Attempt no. 3 : Upload and run the support service on the agent...
Failed to install updates on agent 'rendev000243.ccslab.local'
Error uploading and running update program on agent 'rendev000243.ccslab.local'
Error copying C:\Program Files (x86)\Symantec\CCS\Reporting and Analytics\DPS\AgentUpdate\PU\apu-12.50\windows\smime\esmupdat.exe to rendev000243.ccslab.local
error writing request to update server on rendev000243.ccslab.local
error writing data header to remote process
An established connection was aborted by the software in your host machine
Cause
This is caused by not having applied the HF 10128 (that has the new APU certificate) that was out on the Download Center, prior to June 6th, 2021.
If you check the Agent log you will see the following errors.
[02508] [2021/06/22 06:55:25:282] [INFO] Update server: copy binary file esmupdat.exe
[02508] [2021/06/22 06:55:26:752] [ERROR] Update server: error:21075075:PKCS7 routines:PKCS7_verify:certificate verify error
[02508] [2021/06/22 06:55:26:754] [ERROR] Update server: Signature verification failed for file `C:\Program Files (x86)\Symantec\Enterprise Security Manager\RU\Package\esmupdat.exe', error-code=-8
[10092] [2021/06/22 07:00:38:962] [ERROR] Agent server: error reading message from server; error reading from remote process, header read failed; An existing connection was forcibly closed by the remote host
Resolution
In order to upgrade this Agent after June 6th 2021 (when the old APU certificate expires), you will need to manually upgrade the agent to 12.5.2 or a newer version.
Or uninstall the Agent and do a fresh install of CCS 12.5.2 agent (or newer version) that will have the new APU certificate.
NOTE: If the issue is with an 12.5 agent on a 12.5.2 (or 12.6) Application server (with a manager installed) or a remote 12.5.2 (or 12.6) manager(s), reference this KB article:
CCS Agent Product Update (APU) failed updating the 12.5 agent on the 12.5.2 Application Server or remote manager.
Feedback
