Known issues, limitations, and workarounds

When using the ADT Scan feature, an error message appears in the SA Client when scanning ranges using * or /24 (CIDR) notations.

QCCR1D193587

In some scenarios and network topologies, when scanning for an IPv6-enabled server, the SSH port is shown as unavailable and the agent cannot be deployed.

Independent

From the SA Client, modify the ADT scanning parameters based on the network topology, proxy, and firewall rules.

From SA 10.10, agents use OpenSSL 1.0.1h, which require the presence of the KRNG11i - HP-UX 11.11 Strong Random Number Generator package on the HP-UX 11.11 operating system:

https://h20392.www2.hpe.com/portal/
swdepot/displayProductInfo.do?
productNumber=OPENSSL11I

To ensure that the SA Agent is communicating correctly with the core, install the KRNG11i - HP-UX 11.11 Strong Random Number Generator package for HP-UX 11.11. Here are the details:

https://h20392.www2.hpe.com/portal/
swdepot/displayProductInfo.do?
productNumber=KRNG11I

QCCR1D111925

A deployment which includes a Configuration File component fails without any warning or error when attempting to place a file in a directory which has not been created in advance.

Independent

Ensure that a code (or other type of ADM component) creates the destination directory in preparation for placement by the Configuration File component.

QCCR1D151552

If you cancel a running audit job, and a target server shows a "SKIPPED" job status in the audit results, until an audit has successfully run, the server's compliance view shows the following incorrect status for the policy: “Policy has changed since the last scan”.

Independent

Rerun the audit.

QCCR1D183967

Running a "Users and Group" remediation job with multiple users and user groups will fail with the following error message:  "No Group found".

Independent

Run a "Users and Group" remediation job with user groups followed by a remediation job to remediate users that belong to the remediated user group.

QCCR1D184908

Occasionally, the core recert status will display the message "core recert session not in progress", even though core recert has been executed. This is mostly applicable to the FIPS-enabled customers.

Linux

Generally, waiting 10 minutes or so seems to resolve the problem.

QCCR1D189893

After core recert, infrastructure only (non-slice) boxes do not have proper certificates for the word_upload component, and work_upload may not work properly on that box.

Linux

May be resolved manually by copying certificates in /var/opt/opsware/crypto/word_uploads on box with slice to the corresponding directory on the infrastructure-only box.

QCCR1D191875

During core recert, the security.conf file (in the /etc/opt/opsware/crypto) is created or updated on all cores, slices, and satellites. The core recert process has no obvious way to reach an Oracle-only box that is part of the mesh, so the file is not propagated.

Linux

This is not an issue. If required, a copy of the security.conf file can be copied from one of the mesh's cores to the Oracle-only box.

QCCR1D193091

After upgrading, core from 10.0 to 10.20 and up, the 10.0 satellite is unreachable.

Independent

See https://softwaresupport.hpe.com/group/
softwaresupport/searchresult//
facetsearch/document/KM01365141

QCCR1D157368/160408

Search for IP Address or Hostnames on Add Virtual Server screen does not list HP-UX machines.

HP-UX

Servers can still be listed when "All" is selected on the Add Virtual Server screen.

QCCR1D191478

CentOS 7 Build Plan fails with a TypeError after migration from SA 10.02 with platform installed to SA 10.2.

Independent

None.

QCCR1D135460

Not able to select servers in Run Custom Extensions submenus.

Independent

None.

QCCR1D172654

Unable to start httpsProxy. SA installer should validate /etc/hosts against multiple 'localhost' definitions.

Linux

In the /etc/hosts file, remove 'localhost' and 'localhost.localdomain' from the definition line that begins with:1. Save the file, and retry the installer.

QCCR1D191941/192463

The SA Client progress bars are reduced at a line and does not indicate progress for Windows 8/8.1/2012/2012 R2.

Independent

None.

QCCR1D213050

Launcher cannot log in to SA Core using its IPv6 address.

Independent

This is a Java Web Start issue, not an SA issue. No workaround.

QCCR1D114523

OS Sequences can fail with a persistence error when sequence includes a device group and is run repeatedly

Independent

Use Build Plans to implement the equivalent use-case.

QCCR1D175069/213698

Cannot use an OS Build Plan to provision Windows Server 2012 to a UEFI ProLiant server's second hard disk unless both of the server's hard disks are empty.

Windows 2012

Ensure that all data has been removed from both hard disks, then retry the provisioning.

QCCR1D213391

Running default BP "Add Migrated Linux Server" fails at "Set One Time PXE Boot".

Independent

These build plans are specific to RDP to ICsp migration, so are not applicable to SA.

This issue is caused by incorrect usage of the product.

QCCR1D100566

When the last patch in the job has reboot normal setting, the job status shows the incorrect "Reboot later" information for this patch.

Although the reboot is performed correctly, when previewing the remediation of a patch policy on a server, or viewing the job status for a patch policy that is already remediated, the reboot setting might incorrectly display "Install and Reboot Later" when it should display "Install and Reboot".

Solaris

A workaround is not required because the reboot is performed correctly, even though the display may be incorrect.

QCCR1D102713

Number of rules of patch policy compliance is not correct after remediation or installation of patches.

Independent

From an overall compliance perspective, SA is reporting the correct color. It just does not report the same number of patches before and after the scan. This is controlled by how Microsoft reports applicable/installed patches.

QCCR1D146902/157891

Solaris 11 Patch policies must prevent the user from changing the reboot option from the default option "hold all server reboots until all actions are complete".

Solaris

Always ensure that the reboot option is set to "Hold all server reboots until all actions are complete" when remediating Solaris 11 Patch Policies.

QCCR1D148400

After MBSA import is complete, it takes a long time to update patches in the library and database information in the Admin page.

Windows

No workaround required as it does not impact the functionality.

QCCR1D151092

Customers can view duplicates between HPELN patches and WSUSSCN2.CAB patches. They have to run scripts that delete one of the conflicting patches from the SA database.

Independent

Version agnostic scripts have been provided in a hotfix that can be used to remove patches from the SA database. See https://patch-central.corp.hp.com/crypt-web/protected/viewContent.do?patchId=QCCR1D151092

QCCR1D161961

The Windows 2008 R2 SP1 consists of two binaries. When the user selects the binary with the file name windows6.1-KB976932-X64.exe and clicks Uninstall in actuality, the file is uninstalled and the server reboots and is now on Windows 2008 R2 RTM. However,the job times out and fails.

Windows 2008 R2

No workaround. Problem corrects itself with next scan.

QCCR1D162337

Windows 2k12 software policy remediation fails with the following of error: 'AGENT_ERROR_PATCH_DATABASE_CERTIFICATE_
ERROR'.

Windows 2012;Windows 2012 R2

Import and run the latest (later than October 2012) Microsoft patch CAB file once. You should only have to do this one time.

QCCR1D181473

SAV does not show IPv6 inet addresses or IP address for loopback.

Independent

IP addresses may not appear in IPV6 format for the SAV Isaac release.

QCCR1D92244

Searching on extended ASCII (words containing "ß") characters returns no matching results.

Independent

No workaround till extended ASCII characters are supported.

QCCR1D156389

The Users and Groups SMO will not report all the groups that are created on a Windows 2012 Essentials. If the user properties are edited, these changes will not be reported by the SMO. This means that audits with U&G rules will not be relevant on Windows 2012 Essentials.

Windows 2012

None.

QCCR1D192013

Windows Local Security Settings SMO reports incorrect security settings for entries that are not applicable.

Independent

None.

QCCR1D193063

SMTool upload fails when the /var/tmp folder is not present on the twist box where the command is run.

Independent

Create the expected directory structure.

QCCR1D159841

When performing a core upgrade, you may experience conflicts originating from the UNITS and REALM_UNITS tables.

Independent

To continue with the upgrade process, you must either manually resolve the conflicts or clear them using the force resolver script.

QCCR1D163518

"End Job" button is still enabled after the job has been completed.

Independent

None.

QCCR1D179479/179480

Recurring app config compliance jobs use tokens with a one year lifetime.

Independent

None.

QCCR1D193285

All gateways in a satellite facility should have the same weight defined for primary and backup tunnels.

Independent

None.

QCCR1D166334/188553

SA installed Oracle RDBMS modifies the /etc/sysconfig/selinux file and inserts an entry for SELINUX, regardless of whether a previous entry exists or not.

Linux

If multiple entries exist, then retain the entry that is created by SA. Oracle (SQL*plus, OCI, and so on) will not function properly if SELINUX is set to 'enforcing'. It is suggested that SELINUX be set to 'disabled' or 'permissive'.

QCCR1D191511

There is a connectivity issue between the MM infra slice and the secondary core DB when the secondary core's database is in a RAC configuration and that secondary RAC fails over to a second node. Currently, a manual change to the MGW properties file and the tnsnames.ora files are needed to achieve a failover.

Independent

Bypass the gateway connection from the primary core to the secondary core, and communicate to the RAC. This will provide the ability to continue to communicate if one node goes down. In addition, even if one RAC node goes down, no data is lost. This is because communication is established to the RAC (manual process) and the Multi-master syncs the data.

QCCR1D194366

The data from SA is not loaded correctly and completely when the UCMDB server is configured in multi-tenancy mode.

Independent

None.

QCCR1D141907

If you configure the number of cores per socket using the native vSphere client, and modify the number of virtual processors with a Modify VM job in SA, the CPUs might end up in an invalid configuration. When you edit the CPU settings in the native vSphere client, the error, “Number of cores per socket cannot be greater than number of virtual CPUs” appears when the configuration is invalid.

VMware

If the number of cores per socket for a VM is greater than 1, and you want to modify the CPUs , from SA, set the number of Virtual Processors as a strong multiple of the number of cores per socket.

Else, use the native vSphere client to modify the CPUs.

QCCR1D160891

If a Create VM, Clone VM, or Deploy VM from VM Template job fails running the OSBP, and the VM ends up in a Build Server Failed state, the VM cannot be deleted from the SA Client.

Independent

Delete the VM from the native vendor tool and reload it in SA.

QCCR1D183608

The Openstack VM server is reachable externally only through its public floating IP, not through its internal private IP.

The SA Agent is installed on the server using its Floating IP, so eventually the Management IP of the server is set to its Floating IP.

The server’s operating system is not aware of the Floating IP, so the SA Agent is unable to gather this information. As a result, the server's Floating IP is not present in the interface list for this server nor in the Management IP drop-down list on the server's Network view.

Independent

Do not try to change the IP from its default setting to the internal OpenStack IP.

QCCR1D166350

Jobs remain with an Active status, even though their associated tasks show a status of Success.

Independent

This issue occurs only in multi-core mesh installations where the SA Jobs are being approved using Operations Orchestration on all the cores of the mesh. To work around this issue, set up OO workflow only on the primary core of the mesh.

To resolve this issue:

1. Ensure for all core boxes and satellites boxes in the mesh, /etc/opt/opsware/crypto/security.conf has the FIPS field set to 0.
2. Start the Core component in the order specified by Core Recert document.

When prerequisite checks are run on a 10.5 core (when adding a slice to an existing core), the following message may appear for the servers that have a slice installed: "FAILURE Cannot find installation SQLPlus".