GFI RM - Offline Agent caused by an Upload error

If you find that a GFI Agent cannot upload and communicate with your dashboard then try this quick check for DNS issues.

Overdue Server

So here is my issue, this server is overdue. But it is online in LogMeIn so it is not an Internet access issue. So whats up?

Agent

I check the Agent on the server and here is the issue, Upload error. The Agent cannot communicate with the servers at GFI.

Agent Log

I check the Agent Connection Log and my thoughts are confirmed, we have an invalid response from server error. Now this doesnt mean that the server gave an invalid response, in fact no response is invalid. Any response that is not the right one is invalid, such is the logic in IT.

Advanced Agent Logs

We need to check the logs for what is happening when the Agent tries to communicate. These are located in C:\Program Files (x86)\Advanced Monitoring Agent

Debug Log

The information we need is in the file debug.txt

Inside the log file

Here in the log we can see at 1. that the Agent is trying to resolve the DNS name upload4.systemmonitor.co.uk and that at 2. this is failing. Now I do not know that 0x00002ee7 means a DNS lookup failure, this is a hunch.

Nslookup

So based on my hunch I use nslookup to see if I can resolve the DNS name and I find I cannot. So this means the Agent cannot and therefore I cannot upload.

Nslookup on a working system

Here is the same nslookup on my laptop so now I know that DNS is working on the Internet and it is my server that is the issue.

DNS for Agent

The Agent is running on a network that uses a Windows 2008 R2 Server for DNS, so I check the DNS properties and find there is no forwarder. This means the DNS server cannot lookup domains that it is not responsible for. NB We could talk about Root Hints, but lets not today.

Add Forwarders

In the DNS properties I add two forwarders, I use Open DNS. You should too, there are awesome.

Nslookup with DNS

I now run my nslookup on the Agent Server again and we now have the name resolved.

Agent Checks

I re run the Agent checks and now we have Upload OK. Of course I still have my errors to deal with. I didnt say I was that good.

Cisco ASA CSC - Access to certain websites is very slow with the Trend Security Module

Problems when you have a Cisco ASA 5510 and the CSC Module for Malware scanning.

Reference http://www.cisco.com/en/US/docs/security/csc/csc60/administration/guide/csc8.html#wp1052642

Slow Website Access

The initial issue is that a website is not loading quickly, this will be slower than normal and if you test the website from another Internet connection the page loads normally within a few seconds. You find that it only loads slowly from your network where you have the Cisco ASA 5510 and the CSC Module.

Change ACL for the CSC Traffic

There are some websites that will not work well through the HTTP scanning in the CSC Module and so it is necessary to exclude them from being scanned. This is controlled by your ACL for the CSC traffic.
So in this example we want to exclude the website hosted on 192.168.1.1 so we have to change our acl to first deny traffic to the site we want to exclude and then allow all other traffic. When we access the site on 192.168.1.1 this triggers the deny rule and so the traffic is not included in the class map my_csc_class and thefore it is not passed to the CSC Module for HTTP scanning.
! exempt http traffic to 192.168.1.1
access-list 101 deny tcp any host 192.168.1.1 eq http
! catch everything else
access-list 101 permit tcp any any eq http
class-map my_csc_class
match access-list 101
policy-map my_csc_policy
class my_csc_class
csc fail-close
service-policy my_csc_policy interface inside

Cisco ASA logs

Here you can see the command show access-list csc_out which is the acl for matching the traffic to be scanned, I have added a line
access-list csc_out extended deny tcp 10.0.4.0 255.255.255.192 host 91.206.232.220
The IP address 91.206.232.220 is the actual IP of the site I want to exclude in the real world and now you can see that the hitcount for this is 8 in the deny acl and 150 in the permit acl. So what is happening is that when the site loads the first 4 hits on http are denied as per our acl and then the other hits on http are on our permit acl and are allowed. In this instance the site went from a load of over 2 minutes to under 10 seconds so excluding the IP address of the site in DNS has resolved the issue.

Anti Virus Removal Tools

Many times I will find that an Anti Virus application did not uninstall correctly and multiple registry entries are left behind and you cannot install a new application. So I have a list of the removal tools for several major application vendors that you can use to remove all traces of the applications.

Kapersky - http://support.kaspersky.com/faq/?qid=208279463

Trend Micro Worry Free Business - http://esupport.trendmicro.com/solution/en-us/1057237.aspx

AVG - http://www.avg.com/ww-en/utilities

Sophos - It would appear Sophos do not have a generic tool for removal at present

Symantec - http://www.symantec.com/business/support/index?page=content&id=HOWTO74877 Symantec require you have a Tech Case with them so this is only going to help if you are under contract :(

Citrix XenApp- LDAP in Merchandising Server

When you setup Active Directory Sync in Merchandising Server, you might find this handy for getting the syntax right.

LDAP Syntax

When I was setting up the Active Directory sync in the MS, I understoof the Bind DN field to want a format of CN=sa-receiver,OU=cscm,ou=co,ou=uk but I found this did not work, it actually needs to have the format of domain\username Then you have to make sure the Base DN looks to the OU you have all your tenants located. This may save you some googling and you can spend that time having a brew or some such.

Sharepoint - Missing the PDF icon

Are you missing that PDF icon in your Sharepoint Site? It is not included by default so you have to get a GIF image and then follow this guide from Microsoft.

http://support.microsoft.com/kb/832809

Sharepoint Foundation 2010 - Part 6 Creating a Site Collection

Part 6 will explain creating a Site Collection for users to work with

Create a Site Collection

Choose the option Create site collection to create the first site for users

Web Application to host the site collection

From the Web Application choose the Change Web Application if the application listed is not the one you want to use

Choose the Web Application

Select the web application you want to use

Create the Site

Although a bit hard to see with all the obsfucation here, you can now create your site.

Site Administrators

Choose the Primary and Secondary Site Administrators

Address Book

By choosing the address book you can then look up users in your directory.

Choose Administrator

Choose your site administrator and select them

Quota

For now you have to leave the Quota at no quota as you have not created a quota template.

Sharepoint Foundation 2010 - Part 4 Creating a Site

Part 5 describes how to create a new site.

Create a Managed Account

A new Managed Account will be required for the new site so from Central Administration choose the option Security.

Configure Managed Accounts

Choose the option to Configure managed accounts

Register Managed Account

Choose the option to Register managed account

Create the Service Account

Create a standard domain account and then assign this to the service account credentials

Create Web Application

To create a Web Application choose Managed web applications

Existing Web Applications

Here you can see the existing Web Applications, the first site created and then Central Administration Site. Choose the New option from the ribbon

Create the Web Application

Now you can create the new web application, on the Authentication option keep to using Classic Mode unless you know why to use Claims based authentication. Create a new IIS Site and name this something you can recognise as your site. For the Host Header this will be the named you will use in DNS for the site, so sharepoint.mysite.com example.

Security Configuration

For the security you can keep the defaults, this will mean users will need to authenticate and the site will not use SSL Certificates. In the URL field enter the FQDN you want to use.

Application Pool

The Application Pool will need to be created, this will have a name based on the FQDN of the site and the account being used will be your site managed account.

Database Name

The database server will be your SQL Server and the database name WSS_Content_FQDN Leave the authentication to WIndows Authentication

Search Server

The Search Server will be the server you installed Sharepoint to first.

Complete Application

The Web Application is completed and you are now ready to create a site that users can work with.