Troubleshooting
Problem
When running agents with versions earlier than 3.11.0, it is necessary to perform an initial update to version 3.11.0 before attempting to upgrade to a later 3.11.* version of the Windows agent release. Failure to do so results in subsequent agent updates encountering failures.
Symptom
Unable to update the Windows agent to the latest release.
Despite the global activation of version 3.11.0, online endpoints are displaying a version in the 3.10.X or older range.
Cause
Windows agent version 3.11.0 update is mandatory due to a digital signature change.
Environment
Windows Agent.
Diagnosing The Problem
Use the threat hunt feature and execute the following query:
Note: You can narrow the query down by filtering for the affected endpoint names and groups.
Examine the log results to compare and match them with the examples provided below:
2023-11-0915:15:17 XXXXXX
Custom Event No ProcessAutomatic Update
Component: hive-installer Failed to validate Signature
2023-11-0915:14:01 XXXXXX
Custom Event No ProcessAutomatic Update
Component: hive-installer Failed to validate SignatureResolving The Problem
To resolve the issue, initiate the update process by first upgrading to Windows agent version 3.11.0. Ensure that version 3.11.* is disabled in the update manager during this process. Once the update to 3.11.0 is completed, you can then proceed with the installation.
Document Location
Worldwide
[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSVOEH","label":"IBM Security ReaQta"},"ARM Category":[{"code":"a8m3p000000hBSGAA2","label":"Agent-\u003EInstallation-\u003EWindows"}],"ARM Case Number":"","Platform":[{"code":"PF033","label":"Windows"}],"Version":"All Versions"}]
Product Synonym
ReaQta
Was this topic helpful?
Document Information
Modified date:
09 January 2024
UID
ibm17074079