Kaseya Community

Question about post-patch reboot

This question is not answered

I was looking through Kaseya, and it seems that a number of my machines are rebooting every night due to something in Kaseya.  I have it set to check to see if updates were run every night, and to reboot if so.  I haven't pushed updates for about a week.  Automatic updates are disabled for all machines.  For some machines, it seems to be rebooting either way.

I am trying to compare all of my machines to find a pattern, but none have emerged yet.  There is no pattern in the "Missing Approved" or "Missing Denied" patches.  There is no pattern in the remaining patches that require manual processing.  There is no pattern in Operating System or laptop vs. desktop either.

Any suggestions are greatly appreciated, as I am stumped at this point.  Thanks.

All Replies
  • I'd recommend you check the event logs on the local machine to ensure the reboot is one spawned by Kaseya and, if so, then check the Agent Procedure log.  If the reboot is a result of patch, you should see a "Patch Reboot" agent procedure around the time that the patch install process finished and the reboot procedure was called (depending on the assigned "Reboot Action" you may see a number of patch nags, as well).

    If you aren't able to piece together the information from the logs (they're pretty straightforward when you know what you're looking for but can be a bit daunting if you're unfamiliar with navigating through them), I encourage you to open a ticket with Kaseya Support (portal.kaseya.net).  Be sure to include an example machine, the date/time of the reboot, and any other detail that may be useful in investigating the issue.

  • This is what I saw of interest in the event logs:

     

  • Ok.  Then the patch reboot script did run and it looks like the reboot action is configured to ask the user if it's ok to reboot IF a user is logged in (this screenshot doesn't include the detail of what the response was - this is the procedure history, not the full log, but still enough to garner basic information).  

    The next thing to check would be the Configuration Changes log for the time before 11:34PM for an entry about Automatic Update, Patch Update, Machine Update, or Initial Update to determine which of those functions was responsible for triggering the update process that began around 11:30.  If it was Automatic Update, then you'll see entries regarding the update process beginning right about 11:30.  If it was a patch update or machine update, it could have been scheduled any time prior to the running of the updates, but there will be entries regarding the admin who scheduled those functions (if those functions were used).  Since there was a reboot nag, this wasn't Initial Update.  I'd guess that Automatic Update ran.  Check the function Patch Management > Automatic Updates, look at the schedule for this endpoint.  It's probably configured to run.  The function called Patch Management > Windows Auto Update is NOT the same as the VSA-function called "Automatic Updates".  Windows Auto Update can be disabled, but that does not prevent the schedule under "Automatic Updates" within the VSA from running.  Windows Auto Update disabled sets the GUI on the endpoint from running the local scan/installation of patches (the process most home users have configured to automatically update their personal computers).



    [edited by: Brande Schweitzer at 3:50 PM (GMT -7) on Oct 30, 2012] correction
  • Patch Management -> Automatic update is set to run every night at 11:34pm.  Patch Management -> Windows Auto Update is disabled for all machines.

    I don't know where to get the Configuration Changes log.  If you could direct me to where to get it, I'd be more than happy to put it in here.  For now, this is the entire agent log from a ~24-hour span.

    8:14:20 am 31-Oct-12 Received 1 OOB requests to checkin in the last 348 min 24 sec.

    6:31:54 am 31-Oct-12 Username: xxxxx

    2:25:56 am 31-Oct-12 Received 3 OOB requests to checkin in the last 159 min 55 sec.

    11:48:19 pm 30-Oct-12 ERROR: Could not open c:\kaseyatemp\ptchdlin.xml in getFileEx() task. Code:2

    11:46:01 pm 30-Oct-12 Received 1 OOB requests to checkin in the last 0 min 1 sec.

    11:44:42 pm 30-Oct-12 Agent online

    11:44:40 pm 30-Oct-12 Username: (none)

    11:44:39 pm 30-Oct-12 KAgentExt.dll is loaded. Version 6.2.0.0.

    11:44:28 pm 30-Oct-12 LogParser.dll is loaded. Version 6.2.0.1.

    11:44:28 pm 30-Oct-12 KEventLog.dll is loaded. Version 6.2.0.9.

    11:44:28 pm 30-Oct-12 Agent started - 18 seconds elapsed since system started v6.2.0.8

    11:43:30 pm 30-Oct-12 Agent stopped v6.2.0.8. Agent started at 23:44:05 Oct 29 2012.

    11:43:20 pm 30-Oct-12 Username: (none)

    11:42:07 pm 30-Oct-12 Total 5 keep alives sent.

    11:42:05 pm 30-Oct-12 Initiating reboot in 5 seconds.

    11:34:49 pm 30-Oct-12 Received 1 OOB requests to checkin in the last 498 min 32 sec.

    3:16:17 pm 30-Oct-12 Received 1 OOB requests to checkin in the last 12 min 36 sec.

    3:03:41 pm 30-Oct-12 Received 1 OOB requests to checkin in the last 7 min 2 sec.

    3:03:36 pm 30-Oct-12 Total 6 keep alives sent.

    2:56:39 pm 30-Oct-12 Received 1 OOB requests to checkin in the last 40 min 22 sec.

    2:16:17 pm 30-Oct-12 Received 1 OOB requests to checkin in the last 710 min 21 sec.

    6:19:09 am 30-Oct-12 Username: xxxxx

    2:25:56 am 30-Oct-12 Received 3 OOB requests to checkin in the last 160 min 0 sec.

  • All logs are available under Agent > Agent Logs.  Use the drop down to select the specific log.

    If you have Patch Management > Automatic Update set to run every night at 11:34, then Automatic Update will run every night at 11:34.  If there are any Missing Approved patches to install, the update process will run.  The Reboot Action will be followed at the end of that update process.

    You may have a patch that is failing to install if there are machines running the update every night.  I recommend you open a ticket with Kaseya Support to investigate that failure if you are unable to determine the cause of the failure.

    Kaseya does recommend that Automatic Update is set to run no more often than once per week and no less often than once per month to ensure that endpoints are kept up to date and to minimize impact to end users.

  • Here is the configuration changes log for the last 30 days.

    9:14:43 am 29-Oct-12 Administrator ***** assigned lan watch scan for IP range 10.1.1.1-10.1.1.254.

    8:42:12 am 26-Oct-12 ***** scheduled agent update

    9:27:01 am 24-Oct-12 Admin ***** set Patch File Source to From system server - To temp directory on drive with most free space - Delete after install

    9:18:29 am 24-Oct-12 Admin ***** canceled Automatic Updates for missing patches

    11:34:39 pm 23-Oct-12 Unable to process new patch installation scripts because another patch installation is being processed.

    11:34:39 pm 22-Oct-12 Unable to process new patch installation scripts because another patch installation is being processed.

    11:34:39 pm 21-Oct-12 Unable to process new patch installation scripts because another patch installation is being processed.

    11:34:39 pm 20-Oct-12 Unable to process new patch installation scripts because another patch installation is being processed.

    11:34:40 pm 19-Oct-12 Unable to process new patch installation scripts because another patch installation is being processed.

    9:37:38 am 19-Oct-12 Administrator ***** assigned lan watch scan for IP range 10.1.1.1-10.1.1.254.

    11:34:38 pm 18-Oct-12 Unable to process new patch installation scripts because another patch installation is being processed.

    11:34:40 pm 17-Oct-12 Unable to process new patch installation scripts because another patch installation is being processed.

    11:34:41 pm 16-Oct-12 Started processing Automatic Update

    11:34:41 pm 16-Oct-12 Patch installation scripts have been generated for 13 patches (*System*).

    9:35:20 am 16-Oct-12 Admin ***** scheduled Automatic Updates for missing patches

    2:06:57 pm 11-Oct-12 Administrator ***** assigned lan watch scan for IP range 10.1.1.1-10.1.1.254.

    I will look in to the patches to see if one may not be installing correctly or something.  Thanks.