version control agent trust relationship problem in SIM

[Lenny Davis]

Within SIM (4.1) for 2 of my W2K servers thee is an "i" under the SW column and when you click on it generates the message "version control agent trust relationship problem in SIM"

However when I go to Insight Manager on both servers and select rhe VCA screen the information communicates with my SIM machine fine and displays the Version control information.

How do I get rid of these "i"'s as the VCA is clearly configured correctly so therefore isn't a trust relationship problem at all.

Have run the Software Polling manually several times and this hasn't fixed the problem either.

Thanks

Lenny

[PYMO]

Has there been any solution for this issue? I have the same problem with about 1/3 of my servers and they are all configured the same. I run SIM 5.0 w/SP5 (the latest version).

[Lenny Davis]

Well no-one has contacted me with an answers yet and it is still happening.

Lenny

[frank vandebergh]

Can you try the following:
- go to system management homepage on all servers that have the problem.
- go to settings > security > "Trusted management server".

There's a section "add certificate from server". Enter the name of your sim server and click the button, it should add a certificate.
Once that is done, give sim some time to update the SW status.

[PYMO]

Thanks Frank!
I have done this time and time again and I do an Identify system or/and a Discovery afterwards (even tried to reboot the client system and the SIM server).
They were all configured the same to start with (some had a HP-IM7 version, some were installed from scratch). In the case of one of my servers, it worked for a while, now it doesn't.
I have no problem connecting to the server's HP-SMH page (not asked to authenticate) and from the client's VCA page, I can refresh the inventory data without a hic (confirmed by Event Viewer Log).
I thought it was a Tamper Protection issue from the Symantec Antivirus client, so I disabled it and redid everything...
I'm thinking maybe it is a permission issue (I use a Domain account vs Local - used only for installation of SIM), but I haven't changed a thing from the beginning.
Then, I suspect SNMP but it is configured like the others. (However, I no longer receive trap tests from any of my servers, so I am back to the virus protection issue; which makes me think that maybe none of them work (they worked once but now they mostly are all in the green, so maybe they only look like they do, since most of them do not report the ILO not yet configured).

I am running in circles here... and I fixed two systems that had that Trust problem without knowing what exactly I did to fix it (only that I did and redid the basic steps, which were already done right)

I need ideas from outside the box... What else but SIM, VCA, SNMP and Antivirus could it be? Some AD Global Policies (we are still in a mixed-mode environment, so it would have to be something set by default). The MS firewall is not set on those servers.

There is nothing in the Event Logs of the client server I am currenly trying to fix (the one that did work once).

However, here is a potential issue you might want to check Lenny. If we both have it... maybe...
There are repeated Informational Messages in the Application Event Log of the SIM server with regards to » sshd «.
Do you have it as well? I am not using ssh (or so I think).
py

[frank vandebergh]

Can you post such an SSH error here ?

[Lenny Davis]

Yes I also get lots of sshd errors in the applicatoin log of one of the servers in question. They read:-

The description for Event ID ( 0 ) in Source ( sshd ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. The following information is part of the event: sshd : PID 1576 : error: select: Bad file descriptor.

Lenny

[PYMO]

In my case, I get 5 different messages (well! The end part is different)and it happens everyday mainly at 7:35AM and 8:07AM, but on some days, at other time as well.

The description for Event ID ( 0 ) in Source ( sshd ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event:
sshd : PID 7688 : Received disconnect from "HP-SIM Server IP": 11: The user disconnected the application.

The description for Event ID ( 0 ) in Source ( sshd ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: sshd : PID 7688 : Failed none for illegal user root from "HP-SIM Server IP" port 3263 ssh2.

The description for Event ID ( 0 ) in Source ( sshd ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: sshd : PID 7688 : input_userauth_request: illegal user root.

The description for Event ID ( 0 ) in Source ( sshd ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: sshd : PID 7688 : Illegal user root from "HP-SIM Server IP".

The description for Event ID ( 0 ) in Source ( sshd ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: sshd : PID 7204 : Did not receive identification string from "HP-SIM Server IP".
(The PID is different, but it seems related nonetheless)

However, this morning, after a three days week-end away from me, my problematic system has decided to report back to normal for VCA, and I am still getting those "ssh" error...

So, I am still not any closer to understanding the situation; I hate flaky systems.
I will still look into the ssh issue on my side and report anything I find, however, any insight would be appreciated.

[DEJones_1]

Lenny,

I too have had issues with the Trust Relationships on many servers in our environment. We have over 2500 servers spread across 12 states and the District of Columbia. Since upgrading to SIM5.0 many are not trusting the SMC. Even after running the repair utility I probably have 2 or 3 hundred that still don't work properly.

I have found a solution that seems to work but it took a couple of tries to figure it out.

1) Log onto the SMH for each server.
2) Select settings tab
3) Select the Security link under the System Management Homepage section
4) Select Trust Mode under the Security setting
5) Select the Trust Certificate link at the tail end of the Secure Trust Modes section
6) You may alerady have a certificate installed. If so, click the Remove Cert link. At that point you will see a Success dialog window.
7) On your link bar near the top re-select the Trust Mode link to go back to the Trust Modes page.
8) On the Trust Modes page click the Save Configuration at the bottom.
9) Again you will get a Success dialog window.
10) Again, on your link bar near the top re-select the Trust Mode link to go back to the Trust Modes page.
11) Again select the Trust Certificate link on the Trust Mode page.
12) On the Trusted Management Server Certificates page, at the bottom enter the name of your SIM server and then click the Add Certificate From Server button on the left.
13) On the Verify Certificate for WIL-HPCIM01 page click the Add Certificate to Trust List button at the bottom.
14) Again a Success dialog window appears.
15) Again, on your link bar near the top re-select the Trust Mode link to go back to the Trust Modes page.
16) On the Trust Mode page click on the Save Configuration button at the botton.

You might be able to get away with doing only one save but I do the first to save a clean configuration and then the second to save the updated configuration with the new copy of the cert.

This is very intense, but it worked for me. After my normal polling took place all 10 or so servers that I tried this on displayed the software status.

Hope this helps.

Thanks
Dennis Jones

[Lenny Davis]

Thanks for that comprehensive suggestion. Hasn't worked on the first server I tried and I won't be able to try another one for over a week now but I'll keep you posted.

Lenny