Agent disconnected logs ?
Does the error below point to anything specific? This is from our patching on March 27.
I'm not sure if this was a bad patch or a network issue.
Feb patch was near perfect. No changes to Kace, then March patching had close to half fail due to "error (agent disconnected)". Servers (clients) we patch with Kace include a handful of 2008, 2012r2, 2016 and 2019 for a total of about 150 machines. Most with this issue are 2012r2, but so far I've also found a 2008 and some 2016's. Other servers with the same OS succeeded.
I removed the script identifier. Not every failure was on the same script, but a lot seemed to hit this "exechandler.go:104:finish | Error /exec" on the same script, then fail immediately.
From the konea.log. The patch schedule begins at 21:10. It started well, then failed.
Thank you for any help or suggestions.
020-03-27.21:13:07-0400|INFO |exechandler.go:99:finish | Success /exec |{"script":"SCRIPT 1 ID REMOVED=..."}
2020-03-27.21:13:08-0400|DEBUG|handler.go:29:func1 | Received request |{"method":"POST","url":"/exec?format=split&shell=false"}
2020-03-27.21:13:08-0400|INFO |exechandler.go:312:func1 | POST /exec |{"script":"SCRIPT 2 ID REMOVED=..."}
2020-03-27.22:00:34-0400|INFO |exechandler.go:84:func1 | Request cancelled |{"script":"SCRIPT 2 ID REMOVED=..."}
2020-03-27.22:00:34-0400|INFO |serverconn.go:280:func2 | Disconnected |{"err":"read tcp 137.187.82.19:56897-\u003e137.187.82.138:443: wsarecv: An existing connection was forcibly closed by the remote host."}
2020-03-27.22:00:34-0400|INFO |serverconn.go:136:Run | Reconnecting |{"retry":"75s"}
2020-03-27.22:00:35-0400|INFO |exechandler.go:104:finish | Error /exec |{"code":1,"script":"SCRIPT 2 ID REMOVED=..."}
2020-03-27.22:01:49-0400|INFO |serverconn.go:233:Connect | KUID |{"kuid":"7d33a9e9-5589-45b3-b27e-9822bc1438fb"}
2020-03-27.22:01:49-0400|INFO |serverconn.go:346:createSession | Connecting |{"url":"https://KACE1000 FQDN:443"}
2020-03-27.22:01:49-0400|DEBUG|serverconn.go:317:connect | Connect Query |{"url":"https://KACE1000 FQDN:443/connect?ip=137.187.82.19%3A57363&kuid=7d33a9e9-5589-45b3-b27e-9822bc1438fb&os=windows&ver=10.1.43"}
2020-03-27.22:01:49-0400|INFO |serverconn.go:340:connect | Connected |{"url":"https://KACE1000 FQDN:443"}
2020-03-27.22:01:49-0400|DEBUG|handler.go:29:func1 | Received request |{"method":"PUT","url":"/filesystem/data/amp.conf?atomic=true"}
2020-03-27.22:01:49-0400|INFO |filesystemhandler.go:148:filesystemPutHandler| PUT /filesystem |{"atomic":"true","path":"C:\\ProgramData\\quest\\kace\\amp.conf"}
2020-03-27.22:01:49-0400|INFO |filesystemhandler.go:162:filesystemPutHandler| Contents not modified |{"path":"C:\\ProgramData\\quest\\kace\\amp.conf"}
2020-03-27.22:01:49-0400|DEBUG|handler.go:29:func1 | Received request |{"method":"PUT","url":"/filesystem/data/modules/clientidentifier/data/module.conf?atomic=true"}
2020-03-27.22:01:49-0400|INFO |filesystemhandler.go:148:filesystemPutHandler| PUT /filesystem |{"atomic":"true","path":"C:\\ProgramData\\quest\\kace\\modules\\clientidentifier\\data\\module.conf"}
2020-03-27.22:01:49-0400|INFO |filesystemhandler.go:162:filesystemPutHandler| Contents not modified |{"path":"C:\\ProgramData\\quest\\kace\\modules\\clientidentifier\\data\\module.conf"}
2020-03-27.22:12:51-0400|INFO |konea.go:136:Stop | Service Stopping |
2020-03-27.22:12:51-0400|INFO |module.go:78:Unload | Unloading module |{"name":"clientidentifier"}
2020-03-27.22:12:51-0400|INFO |serverconn.go:280:func2 | Disconnected |{"err":"session shutdown"}
2020-03-27.22:12:51-0400|ERROR|requesterlistener.go:68:Run | Stop Requester Listener |{"err":"accept tcp 127.0.0.1:55097: use of closed network connection"}
2020-03-27.22:12:51-0400|INFO |tunnellistener.go:103:Run | Stop Tunnel Listener |
2020-03-27.22:12:51-0400|INFO |engine.go:53:Run | Stop Engine |
2020-03-27.22:12:51-0400|INFO |konea.go:252:func2 | ======== Stop Konea ========|{"pid":4224}
2020-03-27.22:13:27-0400|INFO |konea.go:247:runKonea | ======== Start Konea ========|{"pid":1416}
Answers (1)
Agent disconnected really means what it said:
The Agent was unable to reach. Could have happened due to some effects like reboot, agent update, network failures etc.
Comments:
-
Therein lies the rub. I'm trying to narrow it down. Far too many machines had this happen where it hadn't happened previously. Agents were all up to date, reboots definitely not the issue. I'm leaning toward a problem with a specific patch or network.
Is there a way to track down which patch was trying to install when a specific script failed by using the ID #?
"IiRLT05FQV9BUFBfRElSXEthY2VQYX....."
I'm assuming this applies to a patch name, but perhaps it's just a function on the K1k. - murbot 4 years ago