VPM Generic Internal Error while patching VPM Server

[Steve Kadish]

SIM generated twelve of these events while doing a patch and fix for the VPM server. Presumably the server was rebooting at the time these were logged.

Unable to connnect to VPM scanner: "java.net.ConnectException: Connection refused: connect"

[Bernardo Tagariello]

Is the IIS server running on the VPM Scanner system?

Has there been a security change with the credentials to the IIS server running the VPM Scanner?

[Steve Kadish]

Hi Bernardo,

Yes and no, respectively.

Thanks,
- Steve

[Bernardo Tagariello]

Were VPM scans running while your were patching?

Are you really patching the VPM server at the same time you are scanning?

We caution against this.

The VPM and HP SIM servers have to be handled carefully, and we do not advise simultaneous operations while they are being updated or scanned.

[Steve Kadish]

Hi Bernardo,

I was not scanning - just patching. Not trying to do two things at once!

- Steve

[Bernardo Tagariello]

Your error message indicates you were attempting a conection to the module which does one of two things:

Scans

Configuraiton Fixes

What were you attempting?

Did they succeed?

As you might imagine, when the VPM system is rebooted, some tasks may come up before others, and they may have tried to reconnect with the VPM scanner module, before it was fully operational.

[Steve Kadish]

Bernardo,

I had run a "Patch-Fix Based on a Scan" on the VPM server. I had not started any other VPM operation. Really. Honest.

This was the first time I had run a "patch-fix" on the VPM server and there were lots of fixes to be applied - several dozen. The VPM server rebooted at least once while fixes were being applied.

Thanks,
- Steve

[Bernardo Tagariello]

Do you know the exact patch or vulnerability number you fixing or patching?

Patching happens in two phases.

1) The target System examines it patch work list. It then compares the work list to target system configuration, and rejects any patches which do not apply (you may see alot of this when people patch without scanning, or the scan is not able to probe for that information). It will set those patches to "Not Applicable". The patches that apply, will be applied, and if reboot is required, it will queue it up. It will set the system's patch entitlement list to be "Reboot Required" if it is needed.

2) If at the end, the system needs to be rebooted because a patch has requested it, it is done. When the system reboot is completed, the patch agent verifies that the reboot was successful, and verifies that the patches were applied, it sends back the "Successful" status.

Now this is differnt than Fix.

Some vulnerabilities are easy configuration fixes. These configuration fixes are handled by the STAT Scanner Engine. It invokes a fix operation, which may be able to simply make the configuration change, and report the status of the fix operation in an HP SIM / VPM Event.

Now these operations should be done at non-peak times, and during times where the system is potentially going to reboot (as you know Microsoft does not always tell you a reboot is required, but does so anyways).

We don't recommend you apply alot of patches to the HP SIM /VPM server, as it may cause a reboot, or reconfigure the system, while you are expecting it to monitor, or react to events from other systems during the period that you are down.

tag

[Steve Kadish]

Hi Bernardo,

I used one of our two free licenses on the VPM server itself, which may have been an error in judgement, but it's too late to change now.

This was the first time I had done a patch/fix operation. There were a lot of patches and fixes being applied, and I have no doubt that the VPM server just rebooted at the wrong time.

Thanks,
- Steve