Troubleshooting Patch management Remediation Problems on managed agent

Assuming that the vulnerabilities were cached, and that the zpm bundles content is available, and that the DAU was run and vulnerabilities were reported for a managed agent, and that the remediation bundle was assigned, how do you troubleshoot problems with remediation failing on the workstation?

See TID 3418069 How to enable debug logging for ZENworks 10 and 11 Configuration Management at support.novell.com knowlegebase:

Component Name: Patch Management for information on which logs to collect from the managed device.  Additionally look in zpm directory on the agent to find the result file *plp_results.txt and WSH events in Application events log.

 

This will show if the patch bundle itself had a problem (err=27, err=20, etc). 

 

Additionally sometimes the Microsoft software update itself will refuse to install for some reason (wrong version of MSI, for example).  In this case look in the Windows Event Viewer under the application log, where the exact command line used will be shown (msiexec /I xxxxxxxxxxxx.msp /qn for example) as well as any error code sent back by Windows Installer.  Turn on msiexec debugging (see http://support.microsoft.com/kb/223300) to see  more details about the MSI failure.  Try running the msiexec command from the particular bundle MSI exec command line without the /s (silent mode) to see if the error appears.

 

Remediate logs also to %ZENWORKS_HOME%\zpm directory for each remediation attempted.

for example, as a test, run:

To produce the output results of MS12-024 Security Update for Windows 7 for x64 (KB 2653956)_5DBE7D3A-54D2-4ABA-BE66-A544655E94DA_results.txt

 

To easily generate a text list of installed Windows updates run the following command: 
wmic qfe list full >updateslist.txt

 

 

Superseded patches:  When a patch is superseded, Patch Management will automatically disable the patch (grey in ZCC).  The patch will not be replaced automatically by superseding patch.  In 11.3 and later, the patch details page will show the superseding patch.  Prior to 11.3:  To find which patch supersedes the disabled patch,  Google example: MS12-050 superseded by site:microsoft.com

 

Typically remediate errors indicate any of:

 

 Possible error codes returned in agent log files (including remediate.exe error codes):