[RESOLVED] Some Agents have been disconnected since update 2.6.0.16881

[ddcorazon]

Hello everyone,

I'm having a small problem since the update to 2.6.0.16881 (it's possible the problem existed before, but it was imperceptible). Many agents are showing as disconnected immediately after installing the update. On these agents, I can run `wapt-get search` and find packages that were added after they "disconnected." However, I think this might not be a good test since it uses a remote repository, which could explain why it's finding packages.
I performed the update yesterday, and some PCs were marked as disconnected all day yesterday, but they're showing up again today.

So, my question is: how can I be sure the agent is communicating with the server (if `wapt-get search` only checks the local repository)? I tried `wapt-get register`, and it tells me the agent is correctly registered on the server, but it still appears as disconnected.

Question 2: This might be unrelated, but on some machines I can perform a WAPT-GET search and find packages, however, when I launch the self-service graphical interface it displays "No results found" ==> Could this be a problem with my server configuration? (It works on some machines.)

I'm not sure if I'm being very clear. Any help would be greatly appreciated.


WAPT Server version: 2.6.0.16881 (Ubuntu 20.04)
WAPT Agent version: 2.6.0.16881
WAPT Setup version: 2.6.0.16881
WAPT Deploy version: 2.6.0.16881
Database status: OK

[dcardon]

Hi Augustin,

could you please check the agent logs \log\waptservice.log for any specific errors? You should normally see lines like "INFO Creating socketio client".

In the latest version, we had a regression if there was a difference between the local name and the AD samAccountName (often due to the machine's initial name being longer than 15 characters, which is quite common on Linux). Could the machines in question be experiencing this issue?

Best regards,

Denis

[ddcorazon]

Hello Denis,

Thank you for the quick reply.

Looking at the logs, I do indeed have warnings; could this be related to the SSL part?

PS: I replaced the server name with wapt.intserver.net but otherwise everything else is intact.

Code: Select all

2025-02-05 13:40:20,100 [waptcore WaptTaskManager 7160] WARNING Unable to update server status : 400 Client Error: Bad Request for url: https://wapt.intserver.net/update_host
2025-02-05 13:40:20,100 [wapttasks WaptTaskManager 7160] WARNING Host on the server is not known or not known under this computer name (known as None). Trying to register the computer...
2025-02-05 13:40:21,061 [waptcore WaptTaskManager 7160] CRITICAL Error sending registration data: status 401 content {"success":false,"msg":"You have to login with proper credentials","error_code":""}
2025-02-05 13:40:21,061 [wapttasks WaptTaskManager 7160] CRITICAL Unable to update server status: Error sending registration data: status 401 content {"success":false,"msg":"You have to login with proper credentials","error_code":""}
2025-02-05 13:40:59,346 [wapttasks SocketIOClient 7164] INFO Socketio connection params have changed. Socketio needs reconnect
2025-02-05 13:40:59,346 [wapttasks SocketIOClient 7164] INFO Creating socketio client: https://wapt.intserver.net:443 client auth cert: ('C:\\Program Files (x86)\\wapt\\private\\sv22dc-003377.mydom.local.crt', 'C:\\Program Files (x86)\\wapt\\private\\sv22dc-003377.mydom.local.pem') proxies: None verify_cert: False
2025-02-05 13:40:59,346 [wapttasks SocketIOClient 7164] INFO Connecting Socketio to https://wapt.intserver.net:443
2025-02-05 13:40:59,412 [waptws SocketIOClient 7164] WARNING Exception ConnectionError('Connection error'), waiting 60s before retrying
2025-02-05 13:41:59,417 [wapttasks SocketIOClient 7164] INFO Socketio connection params have changed. Socketio needs reconnect
2025-02-05 13:41:59,417 [wapttasks SocketIOClient 7164] INFO Creating socketio client: https://wapt.intserver.net:443 client auth cert: ('C:\\Program Files (x86)\\wapt\\private\\sv22dc-003377.mydom.local.crt', 'C:\\Program Files (x86)\\wapt\\private\\sv22dc-003377.mydom.local.pem') proxies: None verify_cert: False
2025-02-05 13:41:59,417 [wapttasks SocketIOClient 7164] INFO Connecting Socketio to https://wapt.intserver.net:443
2025-02-05 13:41:59,465 [waptws SocketIOClient 7164] WARNING Exception ConnectionError('Connection error'), waiting 60s before retrying
Client ('127.0.0.1', 64074) attempted to speak plain HTTP into a TCP connection configured for TLS-only traffic — trying to send back a plain HTTP error response: (1, '[SSL: HTTP_REQUEST] http request (_ssl.c:1147)')
Client ('127.0.0.1', 64076) attempted to speak plain HTTP into a TCP connection configured for TLS-only traffic — trying to send back a plain HTTP error response: (1, '[SSL: HTTP_REQUEST] http request (_ssl.c:1147)')
Client ('127.0.0.1', 64078) attempted to speak plain HTTP into a TCP connection configured for TLS-only traffic — trying to send back a plain HTTP error response: (1, '[SSL: HTTP_REQUEST] http request (_ssl.c:1147)')
2025-02-05 13:42:59,479 [wapttasks SocketIOClient 7164] INFO Socketio connection params have changed. Socketio needs reconnect
2025-02-05 13:42:59,479 [wapttasks SocketIOClient 7164] INFO Creating socketio client: https://wapt.intserver.net:443 client auth cert: ('C:\\Program Files (x86)\\wapt\\private\\sv22dc-003377.mydom.local.crt', 'C:\\Program Files (x86)\\wapt\\private\\sv22dc-003377.mydom.local.pem') proxies: None verify_cert: False
2025-02-05 13:42:59,479 [wapttasks SocketIOClient 7164] INFO Connecting Socketio to https://wapt.intserver.net:443
2025-02-05 13:42:59,567 [waptws SocketIOClient 7164] WARNING Exception ConnectionError('Connection error'), waiting 60s before retrying
2025-02-05 13:43:59,578 [wapttasks SocketIOClient 7164] INFO Socketio connection params have changed. Socketio needs reconnect
2025-02-05 13:43:59,580 [wapttasks SocketIOClient 7164] INFO Creating socketio client: https://wapt.intserver.net:443 client auth cert: ('C:\\Program Files (x86)\\wapt\\private\\sv22dc-003377.mydom.local.crt', 'C:\\Program Files (x86)\\wapt\\private\\sv22dc-003377.mydom.local.pem') proxies: None verify_cert: False
2025-02-05 13:43:59,580 [wapttasks SocketIOClient 7164] INFO Connecting Socketio to https://wapt.intserver.net:443
2025-02-05 13:43:59,660 [waptws SocketIOClient 7164] WARNING Exception ConnectionError('Connection error'), waiting 60s before retrying
2025-02-05 13:44:22,531 [wapttasks WaptTaskManager 7160] INFO Add task Mise à jour de la liste des paquets disponibles to queue
2025-02-05 13:44:22,544 [wapttasks WaptTaskManager 7160] INFO Running task Mise à jour de la liste des paquets disponibles created by SCHEDULER
Get packages index from [<WaptRepo http://wapt-foch-lille.repo.intserver.net/wapt verify_cert=False client_cert_path=C:\Program Files (x86)\wapt\private\sv22dc-003377.mydom.local.crt>, <WaptHostRepo https://wapt.intserver.net/wapt-host for host_id sv22dc-003377.mydom.local >]
2025-02-05 13:44:24,794 [waptcore WaptTaskManager 7160] WARNING Unable to update server status : 400 Client Error: Bad Request for url: https://wapt.intserver.net/update_host
2025-02-05 13:44:24,794 [wapttasks WaptTaskManager 7160] WARNING Host on the server is not known or not known under this computer name (known as None). Trying to register the computer...
2025-02-05 13:44:25,940 [waptcore WaptTaskManager 7160] CRITICAL Error sending registration data: status 401 content {"success":false,"msg":"You have to login with proper credentials","error_code":""}
2025-02-05 13:44:25,940 [wapttasks WaptTaskManager 7160] CRITICAL Unable to update server status: Error sending registration data: status 401 content {"success":false,"msg":"You have to login with proper credentials","error_code":""}
2025-02-05 13:44:59,665 [wapttasks SocketIOClient 7164] INFO Socketio connection params have changed. Socketio needs reconnect
2025-02-05 13:44:59,665 [wapttasks SocketIOClient 7164] INFO Creating socketio client: https://wapt.intserver.net:443 client auth cert: ('C:\\Program Files (x86)\\wapt\\private\\sv22dc-003377.mydom.local.crt', 'C:\\Program Files (x86)\\wapt\\private\\sv22dc-003377.mydom.local.pem') proxies: None verify_cert: False
2025-02-05 13:44:59,665 [wapttasks SocketIOClient 7164] INFO Connecting Socketio to https://wapt.intserver.net:443
2025-02-05 13:44:59,740 [waptws SocketIOClient 7164] WARNING Exception ConnectionError('Connection error'), waiting 60s before retrying
2025-02-05 13:45:59,747 [wapttasks SocketIOClient 7164] INFO Socketio connection params have changed. Socketio needs reconnect
2025-02-05 13:45:59,747 [wapttasks SocketIOClient 7164] INFO Creating socketio client: https://wapt.intserver.net:443 client auth cert: ('C:\\Program Files (x86)\\wapt\\private\\sv22dc-003377.mydom.local.crt', 'C:\\Program Files (x86)\\wapt\\private\\sv22dc-003377.mydom.local.pem') proxies: None verify_cert: False
2025-02-05 13:45:59,747 [wapttasks SocketIOClient 7164] INFO Connecting Socketio to https://wapt.intserver.net:443
2025-02-05 13:45:59,806 [waptws SocketIOClient 7164] WARNING Exception ConnectionError('Connection error'), waiting 60s before retrying
2025-02-05 13:46:59,811 [wapttasks SocketIOClient 7164] INFO Socketio connection params have changed. Socketio needs reconnect
2025-02-05 13:46:59,811 [wapttasks SocketIOClient 7164] INFO Creating socketio client: https://wapt.intserver.net:443 client auth cert: ('C:\\Program Files (x86)\\wapt\\private\\sv22dc-003377.mydom.local.crt', 'C:\\Program Files (x86)\\wapt\\private\\sv22dc-003377.mydom.local.pem') proxies: None verify_cert: False
2025-02-05 13:46:59,811 [wapttasks SocketIOClient 7164] INFO Connecting Socketio to https://wapt.intserver.net:443
2025-02-05 13:46:59,855 [waptws SocketIOClient 7164] WARNING Exception ConnectionError('Connection error'), waiting 60s before retrying
2025-02-05 13:47:59,858 [wapttasks SocketIOClient 7164] INFO Socketio connection params have changed. Socketio needs reconnect
2025-02-05 13:47:59,858 [wapttasks SocketIOClient 7164] INFO Creating socketio client: https://wapt.intserver.net:443 client auth cert: ('C:\\Program Files (x86)\\wapt\\private\\sv22dc-003377.mydom.local.crt', 'C:\\Program Files (x86)\\wapt\\private\\sv22dc-003377.mydom.local.pem') proxies: None verify_cert: False
2025-02-05 13:47:59,858 [wapttasks SocketIOClient 7164] INFO Connecting Socketio to https://wapt.intserver.net:443
2025-02-05 13:47:59,915 [waptws SocketIOClient 7164] WARNING Exception ConnectionError('Connection error'), waiting 60s before retrying
2025-02-05 13:48:59,925 [wapttasks SocketIOClient 7164] INFO Socketio connection params have changed. Socketio needs reconnect

Initially, I believe I understand that it can't find a host for that name on the server (the server name hasn't changed in the meantime); it's 13 characters long if we don't count the domain name
Either I misunderstood, or he's trying to use HTTP with the server using HTTPS?
Regarding the name, in this case the samAccountName AD and the local name are the same
Below is the content of the wapt-get.ini file directly on the client

Code: Select all

[global]
use_hostpackages=1
peercache_enable=0
use_kerberos=0
max_gpo_script_wait=180
pre_shutdown_timeout=180
hiberboot_enabled=0
repo_url=https://wapt.intserver.net/wapt
wapt_server=https://wapt.intserver.net
verify_cert=0
use_fqdn_as_uuid=1
allow_remote_reboot=1
allow_remote_shutdown=1
use_repo_rules=True

[default_global]
use_hostpackages=1
peercache_enable=0
use_kerberos=0
max_gpo_script_wait=180
pre_shutdown_timeout=180
hiberboot_enabled=0
repo_url=https://wapt.intserver.net/wapt
wapt_server=https://wapt.intserver.net
verify_cert=0
use_fqdn_as_uuid=1
allow_remote_reboot=1
allow_remote_shutdown=1

[waptwua]
enabled=True
default_allow=True
install_at_shutdown=True
download_scheduling=12h

[default_waptwua]

wapt3.png (10.12 KB) Viewed 9926 times

wapt4.png (14.95 KB) Viewed 9926 times

waptt.png (18.6 KB) Viewed 9926 times

[dcardon]

Hi Augustin,

it seems the agent's client certificate is no longer accepted by the server. It's trying to re-register, but since it doesn't have a Kerberos configuration, it needs a login/password.

From which version of WAPT was the upgrade performed? The certificate in the agent's /private folder is indeed signed by the server's CA (you can double-click the .crt file to see if it's self-signed or signed by an authority).

If you register manually, does the machine reconnect correctly?

Best regards,

Denis

[tux]

Good morning,

For your information, I am observing the same problem on version 2.6.0.16795.

Code: Select all

Client ('127.0.0.1', 49990) attempted to speak plain HTTP into a TCP connection configured for TLS-only traffic — trying to send back a plain HTTP error response: (1, '[SSL: HTTP_REQUEST] http request (_ssl.c:1147)')

[dcardon]

Hello,

@Sébastien, is the agent configured for HTTP or HTTPS? Is this communication with the local agent or with the server?

@Augustin, is the problem resolved on your end?

Regards,

Denis

[tux]

For me, it's configured as HTTPS.
I see this error during package installation or machine refresh.

On a client machine, I found the following in the logs (C:\Program Files (x86)\wapt\log\waptservice.log):

Code: Select all

2025-02-11 16:49:08,424 [wapttasks WaptTaskManager 8684] INFO update_server_status successful (data size:19945, keys:dict_keys(['uuid', 'computer_fqdn', 'host_metrics', 'installed_packages', 'packages_audit_status', 'last_update_status', 'status_hashes']))
Client ('127.0.0.1', 58183) attempted to speak plain HTTP into a TCP connection configured for TLS-only traffic — trying to send back a plain HTTP error response: (1, '[SSL: HTTP_REQUEST] http request (_ssl.c:1147)')

[htouvet]

Hello,
the error "attempted to speak plain HTTP into a TCP connection configured for TLS-only traffic" on local service 8088 is not problematic.

It's a bug in version 16881. The local service has now switched to HTTPS for security reasons, but waptdeploy hadn't been switched to HTTPS as well.

(waptdeploy.exe tries to "ping" the local service using HTTP instead of HTTPS, either through the GPO that launches it at machine startup, or the waptupgrade package also uses it to check if any tasks are running before stopping the service.)

[ddcorazon]

Hello Denis,

Sorry for the delay. The upgrade was performed from the previous version (I don't remember it offhand, but it was 2.6.0.16613, if I recall correctly)

I just checked, and the certificate is self-signed. Actually, I have two certificates in the folder. The one with the server name is self-signed (possibly because it was also a secondary repository at one point?), and the other, named with the server's UUID, is signed by our server.

wap1.png (33.25 KB) Viewed 9714 times

wap3.png (64.08 KB) Viewed 9714 times

When I run `wapt-get register` (without a password), it says the inventory was successfully sent to the server, but it doesn't update. The last time I had this issue on a machine (I didn't have time to investigate), I resolved it by completely uninstalling and reinstalling the agent.
Sincerely

Augustin

[ddcorazon]

Hello,

Well, I finally uninstalled and reinstalled WAPT. It re-registered normally.