NRI Agent Scan Fails to Generate Signature .xiu File After Upgrade to 14.6 (Missing UUID/General Tab)

Products

• CA Client Automation - IT Client Manager

Issue/Introduction

After upgrading the NRI scanner from 14.0 to 14.6, the signature.xiu file is not generated correctly. UUID and General tab information are missing. Running caevmscli manually may result in errors regarding missing GLIBC and CXXABI symbol versions.

Environment

Client Automation (IT Client Manager
RHEL 8

Cause

The NRI Agent scanner (caevmscli) in version 14.6 is compiled against newer system library requirements (GLIBC_2.27 and specific CXXABI versions) than those available on standard RHEL 8 environments. Any Linux with the glibc version less than 2.27 may have this issue. This incompatibility prevents the scanner from executing correctly, leading to null or incomplete signature files.

Resolution

This issue is addressed by applying testfix T5J8155, which provides a updated caevmscli binary with static linking of the required Xerces libraries to resolve the OS-level library dependency conflict.

1. Apply the Fix: Contact Broadcom Support to obtain and deploy the official testfix T5J8155.
2. Verify Signature Generation: After deployment, trigger a new scan and verify that the signature.xiu file is correctly generated with the expected UUID and General tab information.

Best Practices for Signature Management

To ensure consistent signature detection when using custom .ZML files:

• Use Custom Signatures: Continue to use your custom signature files (e.g., L000001.ZML) instead of relying on the stock catalog (L0000039.ZML) for specialized detection requirements.
• Prevent Overwriting: The NRI agent only maintains one active signature file at a time. If multiple signature files exist in the package directory, the agent automatically retains the one with the higher embedded version number and discards the other.
• Merging Rules: If you wish to use both custom rules and stock signatures, merge them into a single file and assign it a version number higher than the stock file (e.g., L0000040.ZML or higher) to ensure it is retained by the agent.