Hello LANDesk Community,
recently I discovered a strange behavior of our vulscan tasks and hopefully you can provide some help or hints.
We did not notice the issue back with LANDesk Management Suite (LDMS) 9.6 without service pack.
A few weeks ago we updated to LDMS 9.6 SP2 (2015-0706B BASE + 9.60.2.72A LDMS).
Afterwards we see that tasks executed from the core server are still fine.
However tasks that are scheduled locally on the servers to be patched by landesk seem to run at different times than originally planned.
That being said I will give you a rough roundup about the environment and the issue itself.
Environment
Core Server
OS: Windows Server 2012 R2, English
LDMS: 9.6 SP2 (2015-0706B BASE + 9.60.2.72A LDMS), English
Time format: US
Server(s) to be patched
OS: Windows 2008, 2008R2, 2012, 2012 R2, German/English
Time format: US/German
Agent Configuration (Scan Only)
Distribution and Patch --- Patch-Only Settings --- Scan options
Type = vulnerabilities + custom definitions
Autofix = not enabled
Distribution and Patch --- Patch-Only Settings --- Scan options --- Schedule
Start [Date] at 11:30:00
Repeat after: 3 Days
Additional random delay: up to 1 hour and at least 30 minutes
This should result in scanning between 12:00 and 12:30 (mealtime).
I would like to use time ranges instead but I can not see how to set a limit at 12:30 then.
Planned Tasks (Repair Only)
We schedule the repair of patches by repair tasks referring to custom groups including the patch definitions.
Tuesday at 04:15 (am)
Saturday at 04:15 (am)
Maintenance Window
Tuesday 04:10 (am) - 05:00 (am)
Saturday 04:10 (am) - 05:00 (am)
Reboot Time Window
Tuesday 04:10 (am) - 05:00 (am)
Saturday 04:10 (am) - 05:00 (am)
Issue
The following is an example of one server with Windows Server 2012 R2, English + US time format.
With a scan every three days and repair tasks running two times a week you should expect a maximum of two new vulscan logfiles.
However I got four of them.
One of them is correct, a second one was my failure while the remaining two leave me puzzled.
vulscan3.log - Code 402 (only scan) at 12th of October around 17:00 <- only scan is correct, time is totally wrong
vulscan2.log - Code 403 (autofix) at 12th of October around 21:00 <- no clue where that comes from
vulscan1.log - Code 403 (autofix) at 12th of October around 4:15 <- everything is fine here
vulscan.log - Code 403 (autofix) at 12th of October around 4:19 <- my failure -.-"
So we are looking at vulscan3.log and vulscan2.log.
The time of vulscan3 reappears in the localsch.exe /Tasks |more with the following information:
Filter 1 : [Auto delay] State=(Not ready) Min=(30) Max=(60).
It seems that the scan is the one supposed to run from 12:00 to 12:30 (see above).
Since we do not have any other other task with this specific delay I am pretty sure it is.
But why is the task planned for 17:00 instead of 12:00?
Vulscan2 leaves me without any clue.
Within the logfile it is written "Parent process: 13088 (LANDESKAgentBootStrap.exe)".
However the only agent setting directly related to scanning the devices is the one supposed to run between 12:00 and 12:30.
Any chance to track down where that task comes from?
Conclusion
One task (vulscan3) with times of +5 hours to the planned task and another one that seems to come out of nowhere.
Hopefully you can give me some hints how to find the source of these problems.
Best regards,
Timo Liedtke
