C4A 3.6 updates/changes

[Cubert]

As a side note,

I added several "Optional" flags by each step. If you are not using network cache or sources then you would not need to manage these settings. Also , you are not required to "install approved software" so you can run without it if your only wanting to update existing Chocolatey packages.

Just enabling an agent should force a test for Chocolatey framework on agent and a install of Chocolatey followed by a scan. If scan reports software back then its added to the managed software list and will update that list once agents reached the correct position in the process.

[PL-MSTech]

So, most of our app packages have installed, but have not updated. Chocolatey itself even is on some very old versions. I have poured through your scripts annd logs and cannot find where they issue an update command. I have a 2-line shell script in automate that simply runs Chico update all -y that I tried on a c4a managed machine and it updated everything beautifully.
What am I missing on having c4a keep everything updated rather than just doing an initial install?

[Cubert]

Here is what should be happening. In my case here, this client is set to daily updates which automatically happen at 12 AM daily. We do not schedule a script to update agents, we actually send down a direct command to execute on the agent. This command is crafted to force the update process into the Windows background and releases the LTagent service from waiting on command to finish. This is done this way as a large set of applications being updated could exceed the LT command timeout limit of 5 minutes.

Screenshot 2024-04-17 084957.png (161 KiB) Viewed 205 times

There are some requirements that must be met before command is sent.

#1 (ChocoApproved = 1 And ChocoInstalled = 1) Chocolatey framework must show as installed in database and that agent is enabled for Chocolatey

#2 (Agent Online = 1) Agent must also be online at the time of command.


Typically #2 is your issue, If your Windows desktops goes to sleep at night then they will be skipped during the 12 am update call.



Not to bait and switch you, but in our latest plugin, Automate Package Manager, we addressed this limitation in scheduling by allowing you to also manage the time of day we push out updates.

In APM, you not only get to manage Chocolatey but Homebrew, Apt (Ubuntu), Yum (RedHat), and Zypper (openSUSE) all in the same style and views seamlessly. We also now deploy policies for software installs and updates allowing you to centralize the management of policies across the RMM environment.

Improved design, does more, more efficient, policy driven and costs the same as C4A.

The nice thing is, if you don't have a need for Mac and Linux software management then just don't create policies with Mac or Linux selected in policies. You Mac and Linux agents will remain untouched by APM.

Screenshot 2024-04-17 090145.png (55.47 KiB) Viewed 205 times

See a Video demo of APM in action

viewtopic.php?t=6343

[PL-MSTech]

No offense, but after nearly a year of paying for C4A and it not functioning as expected, I believe we will hold off on any additions at this time.
I deployed the framework again...although it was already deployed. I then made sure the agent was online and not asleep. I then attempted to use the (update now) in the plugin. If I understand correctly this should update the packages...INCLUDING Chocolatey. I then launched a scan so that it would update the EDF. The (update now) ran successfully. But it did not update anything. The version of Chocolatey on the agent is still 1.1.0. This is the version that the agent started on. Will you please explain to me why the (update now) does not work? Is it supposed to do something? Is it supposed to update the packages including Chocolatey?

[PL-MSTech]

Just in case it is needed for you to be able to assist with this issue I am going to add screenshots for the outputs for the update command and the scan command.

[Cubert]

From your data I can only conclude that there is something with agent that is wrong or rejecting the command. Everything from the plugins perspective appears to be accurate and working as it should.


#1 We see agent being sent command
#2 The command is accurate and without syntax errors
#3 We see scans for installed packages complete successfully
#4 We see data from scans in plugin.

But after a rescan of agent we still get Chocolatey at Version 1

I believe what maybe happening is it will start the upgrade process, upgrades several packages then blows up during the upgrades and dies leaving some subset of all packages at original version. This would be a Chocolatey error, not a plugin failure.


I notice that only a few packages are out of date (Chocolatey, Firefox, Google Chrome and Dropbox). I think maybe one of these updates is missing something and errors in Chocolatey. Then chocolatey stops at that point and ends the process. I would suspect Google Chrome maybe the issue. We have seen Google Chrome in the past require special Chocolatey-extension add-on to allow installs to complete correctly, however I see you have them installed on this agent already. So this maybe is not your issue.

To test this theory, on this agent open a command line and execute the command "c:\programdata\chocolatey\bin\choco.exe upgrade all -y" just like the image you posted but without the running as a process. Allow the return to come back to your terminal and see what it returns.

I would expect some error to be returned from Chocolatey.


Post your errors if any here.

[Cubert]

I just happen to have an example issues here I came across on my own system when responding to your post. I wanted to validate the command syntax so I ran it in a terminal on my own PC and the upgrade all was going along just fine till this popped up on my desktop.

Screenshot 2024-04-18 092435.png (74.4 KiB) Viewed 157 times

In the middle of my upgrade all execution, I get a dialog box to uninstall a previous version of GhostScript before it can continue. If no one accepts this then this just sits there in limbo. If it was launched from Automate as a terminal command, there in no desktop to pop in to.

This is a direct result of the package maintainers failure to create a headless uninstaller as part of package manifest. Instead the maintainer just calls the executables uninstaller executable directly with out switched for silent uninstalls.

A good note that with Chocolatey, Not all packages built the same and may cause unexpected results.

[Cubert]

I accepted the Ghostscript uninstall and allowed the manual update to complete.

Upon completion I received this return:

Screenshot 2024-04-18 094814.png (37.05 KiB) Viewed 155 times

Google failed to update, Tells me to go see logs on why.

logs='C:\ProgramData\chocolatey\logs\chocolatey.log'

2024-04-18 09:40:48,253 13744 [ERROR] - ERROR: Checksum for 'C:\Users\sanderson\AppData\Local\Temp\chocolatey\GoogleChrome\124.0.6367.60\googlechromestandaloneenterprise64.msi' did not meet '6924105331effa0a710a27e0ba90088e8bbfd7e3dce953c1cb83662298251113' for checksum type 'sha256'. Consider passing the actual checksums through with --checksum --checksum64 once you validate the checksums are appropriate. A less secure option is to pass --ignore-checksums if necessary.
2024-04-18 09:40:48,253 13744 [DEBUG] - Built-in PowerShell host called with ['[System.Threading.Thread]::CurrentThread.CurrentCulture = '';[System.Threading.Thread]::CurrentThread.CurrentUICulture = '';[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::SystemDefault; & import-module -name 'C:\ProgramData\chocolatey\helpers\chocolateyInstaller.psm1'; & 'C:\ProgramData\chocolatey\helpers\chocolateyScriptRunner.ps1' -packageScript 'C:\ProgramData\chocolatey\lib\GoogleChrome\tools\chocolateyInstall.ps1' -installArguments '' -packageParameters '' -preRunHookScripts $null -postRunHookScripts $null'] exited with '-1'.
2024-04-18 09:40:48,253 13744 [DEBUG] - Calling command ['"C:\WINDOWS\System32\shutdown.exe" /a']
2024-04-18 09:40:48,284 13744 [DEBUG] - Command ['"C:\WINDOWS\System32\shutdown.exe" /a'] exited with '1116'
2024-04-18 09:40:48,331 13744 [DEBUG] - Capturing package files in 'C:\ProgramData\chocolatey\lib\GoogleChrome'
2024-04-18 09:40:48,331 13744 [DEBUG] - Found 'C:\ProgramData\chocolatey\lib\GoogleChrome\GoogleChrome.nupkg'
with checksum '77BF68E88CEA32D6CD32FDC4A07FBF82'
2024-04-18 09:40:48,331 13744 [DEBUG] - Found 'C:\ProgramData\chocolatey\lib\GoogleChrome\googlechrome.nuspec'
with checksum '501D6B5EB87243C343BA4D51E7356771'
2024-04-18 09:40:48,331 13744 [DEBUG] - Found 'C:\ProgramData\chocolatey\lib\GoogleChrome\tools\chocolateyInstall.ps1'
with checksum '518F9A64851BE1C690B68333690914EC'
2024-04-18 09:40:48,331 13744 [DEBUG] - Found 'C:\ProgramData\chocolatey\lib\GoogleChrome\tools\helpers.ps1'
with checksum '2ABBC7E4384A2837486A47E0378C6CCB'
2024-04-18 09:40:48,331 13744 [DEBUG] - Attempting to create directory "C:\ProgramData\chocolatey\.chocolatey\GoogleChrome.124.0.6367.60".
2024-04-18 09:40:48,347 13744 [DEBUG] - There was no original file at 'C:\ProgramData\chocolatey\.chocolatey\GoogleChrome.124.0.6367.60\.files'
2024-04-18 09:40:48,347 13744 [DEBUG] - Attempting to delete file "C:\ProgramData\chocolatey\.chocolatey\GoogleChrome.124.0.6367.60\.arguments".
2024-04-18 09:40:48,347 13744 [DEBUG] - Attempting to delete file "C:\ProgramData\chocolatey\.chocolatey\GoogleChrome.124.0.6367.60\.extra".
2024-04-18 09:40:48,347 13744 [DEBUG] - Attempting to delete file "C:\ProgramData\chocolatey\.chocolatey\GoogleChrome.124.0.6367.60\.version".
2024-04-18 09:40:48,347 13744 [DEBUG] - Attempting to delete file "C:\ProgramData\chocolatey\.chocolatey\GoogleChrome.124.0.6367.60\.sxs".
2024-04-18 09:40:48,347 13744 [DEBUG] - Attempting to delete file "C:\ProgramData\chocolatey\.chocolatey\GoogleChrome.124.0.6367.60\.pin".
2024-04-18 09:40:48,347 13744 [DEBUG] - Sending message 'HandlePackageResultCompletedMessage' out if there are subscribers...
2024-04-18 09:40:48,347 13744 [ERROR] - The upgrade of GoogleChrome was NOT successful.
2024-04-18 09:40:48,347 13744 [ERROR] - Error while running 'C:\ProgramData\chocolatey\lib\GoogleChrome\tools\chocolateyInstall.ps1'.
See log for details.
2024-04-18 09:40:48,347 13744 [DEBUG] - Attempting to create directory "C:\ProgramData\chocolatey\lib-bad".
2024-04-18 09:40:48,347 13744 [DEBUG] - Attempting to create directory "C:\ProgramData\chocolatey\lib-bad\GoogleChrome".
2024-04-18 09:40:48,347 13744 [DEBUG] - Moving C:\ProgramData\chocolatey\lib\GoogleChrome to C:\ProgramData\chocolatey\lib-bad\GoogleChrome\124.0.6367.60
2024-04-18 09:40:48,347 13744 [DEBUG] - Moving 'C:\ProgramData\chocolatey\lib\GoogleChrome'
to 'C:\ProgramData\chocolatey\lib-bad\GoogleChrome\124.0.6367.60'
2024-04-18 09:40:50,356 13744 [DEBUG] - Attempting rollback
2024-04-18 09:40:50,356 13744 [DEBUG] - Moving C:\ProgramData\chocolatey\lib-bkp\GoogleChrome\117.0.5938.89 to C:\ProgramData\chocolatey\lib\GoogleChrome
2024-04-18 09:40:50,356 13744 [DEBUG] - Moving 'C:\ProgramData\chocolatey\lib-bkp\GoogleChrome\117.0.5938.89'
to 'C:\ProgramData\chocolatey\lib\GoogleChrome'
2024-04-18 09:40:52,365 13744 [DEBUG] - Attempting to delete directory "C:\ProgramData\chocolatey\lib-bkp\GoogleChrome".

Hmmm... maybe a chucksum error with package? That seems to be the first error

Condensed version:

2024-04-18 09:40:48,253 13744 [ERROR] - ERROR: Checksum for 'C:\Users\sanderson\AppData\Local\Temp\chocolatey\GoogleChrome\124.0.6367.60\googlechromestandaloneenterprise64.msi' did not meet '6924105331effa0a710a27e0ba90088e8bbfd7e3dce953c1cb83662298251113' for checksum type 'sha256'. Consider passing the actual checksums through with --checksum --checksum64 once you validate the checksums are appropriate. A less secure option is to pass --ignore-checksums if necessary.

2024-04-18 09:40:48,347 13744 [ERROR] - The upgrade of GoogleChrome was NOT successful.

2024-04-18 09:40:48,347 13744 [ERROR] - Error while running 'C:\ProgramData\chocolatey\lib\GoogleChrome\tools\chocolateyInstall.ps1'.

[Cubert]

I have released build 3.6.0.10 that adds 2 new features to Chocolatey.

#1 Added Error logging retrieve to the Chocolatey scanner script. It will look for and parse out the chocolatey.log file looking for Errors, If it finds any errors in log it will capture the error and date and save it to Automate.

It will then remove the log file. Next scan will repeat the log scan, if new file appears with errors in it the current logs will be replaced with the new logs.

This means you could have potential logs on any update or install execution. If errors exits we will import them. You will only ever see Error logs and only the latest errors.

#2 We added a Chocolatey Source reset to the Scanner script. If agents had either sources or UNC enabled, then disables them both, the scanner script on next scan will auto reset the default repo back to chocolatey public repo.

Auto Updates should happen tonight!


Here is new log tab under agent views:

Screenshot 2024-04-19 122244.png (56.91 KiB) Viewed 127 times

[PL-MSTech]

Is there also an added feature to skip such updates with a timeout (because of pop-ups, etc. as your ghostscript example above) and continue with the rest of the packages that may not require interaction, then log such exceptions?