that list looks right, is there anything in the appserver log that might indicate why it's skipping the file?
this guy: https://www.bladelogic.com/community/thread.jspa?threadID=4047&tstart=0 ran into some PA issues too though he seems to have gotten the qnumber list working.
when you do the 'filter out' are you using the same file?
and whate version of the appserver are you using ?
Thanks for the reply.
Appserver is running v22.214.171.1247. Where would I find the logs for it?
The job log does have entries that read Using file "//path/to/our/file/include.txt" as an Include filter on patch analysis, so it is doing something with that file.
We use a different file for the "exclude", but it is formatted exactly the same and saved in the same folder on the server. Nothing fancy, they are just straight-up text files, edited in Notepad, named "include.txt" and "exclude.txt".
/usr/nsh/br/appserver.log, Program Files\BladeLogic\OM\br\appserver.log
if you are running multiple instances on the system you may see logs like "jobserver1.log", if so you'd need to look in the GUI job log and figure out what instance/appserver it's running on and look at the appropriate log.
Where is the white list stored?
I think the file has to be on a machine with an agent; ie, I pick it up through the remote server tree, not local machine tree.
Okay, I took a look through the job log. In this case, there aren't any glaring errors that jump out at me (there are a couple null pointer errors earlier in the file that I don't believe are related); in fact, I do see this kind of thing a number of times:
(Using pastebin to avoid killing the thread due to horizontal screen scroll!)
In this case, the include file I was using was named "wr_include_Exchange.txt".
@Wenchi Liao: File is stored locally on the application server, but it has the agent installed on it and I get to the file using the browse button. On the screen where the options are specified, it is referenced using the proper "//server_name/folder/filename.txt" syntax.
can you tell if that file is getting copied over to the target server during the PAJ run?
How would I know... is that something that would show up in the logfile?
I do see lines that look like this: *
Executing command: BLPatchCheck2 0 -pt 13 -qf "_C:/BladeLogic/RSC/tmp/hfnetchk6b94253/wr_include_Exchange.txt_" -s "C:/BladeLogic/RSC/tmp/hfnetchk6b94253/hfnetchk6b.cab" "C:/BladeLogic/RSC/tmp/shavlik_results94304.xml"*
C:\BladeLogic\ is the server install path for the RSCD agent, so it looks to me like it has copied the whitelist file out to the remote server (assuming that the slashes going the other direction are okay). I'm guessing that since the BLPatchCheck2 command is taking that filename as an argument that the server is looking at it (though I don't know the full syntax of that command).
Sounds like this is a doozy. :)
Does the target also have a 7.44 agent? I've seen this problem when a 7.4 appserver analyzes a non 7.4 agent.
How would I know... is that something that would show
up in the logfile?
I found hints of this in the agent log file of the target machine. I ran
bllogman cat "//targetmachine/.../RSC/rscd.log" | grep WHITELISTNAME
and saw messages like
CM: > [PatchAnalysis] Deleting //targetmachine/.../WHITELISTNAME
That seems like a safety check and not a real indicator. During a patch analysis, you could hop over to the machine and visually inspect the path displayed to see if the file is created.
I do see lines that look like this: *
Executing command: BLPatchCheck2 0 -pt 13 -qf
For what it's worth, I see a similar message on a successful whitelist patch analysis. The whitelist itself is on a separate machine (not app server, not target server).
I'm still getting this problem. Client is at v126.96.36.199. Anyone ever figure out the problem? My "analyze only" file has only three Q numbers in it, but the PA still scans *everything*.
Can you run a dos2unix on the file and then respecify it again? Just a guess.
I converted the file to Unix with UltraEdit and completely rebuilt the job to ensure I was using the new format. Got the same results.
Have Mike open a ticket with this with BMC. I think I have heard of this being resolved before, but I do not remember. When we identify the resolution, we will post it here for all to benefit from.