Software Update Server not working - Firewall?

Question

Software Update Server not working - Firewall?

Hi all,
I am having a good bit of trouble with Software Update Service on my OS X 10.5.5 server.

Through WGM I currently have all my clients looking to the server. They show the server's FQDN in the title bar wen Software Update is running, so I think that portion of the link is working.

The issue I seem to be having is in getting the server to download updates from Apple.

Currently in Server AdminI see a massive list of updates that have been available from Apple for some time now, including items released from 9/9/08-9/18/08.

All of these items have a blue exclamation mark next to them, and I am unable to copy or enable them.

The software update service log shows hundreds of messages like the following:

+Tue Sep 23 07:28:33 servername.domainname.com swupd_syncd[13927] <Error>: Unable to download upstream catalog index (was looking for http://swscan.apple.com/content/meta/mirror-config-1.plist)+

The other tow logs don't show anything of interest to me, but perhaps I don't know what to look for.

I am sure that this is related to my firewall, but I don't know what SUS need to see the outside world. Currently the server has the ability to make un-proxied http connections on port 80. I don't think that that is enough.

Any help you can offer would be greatly appreciated.

Bill

PowerMac G5 DualCore 2.3 4.5GB, Mac OS X (10.4.6)

Posted on Sep 23, 2008 7:54 AM

Reply

Answer 1

Andbrowny

Level 4

1,614 points

Sep 23, 2008 1:15 PM in response to W. S. Wellington

Hi W. S., can you get to http://swscan.apple.com/content/meta/mirror-config-1.plist in safari? if you can then save that file to your desktop as a text file and then rename it by deleting the .txt from the end and click use .plist open Finder and go to /usr/share/swupd/html and place a copy of that mirror-config-1.plist file there and a copy in /usr/share/swupd/content/catalogs/ then restart the server.
See if that helps.
Cheers

Reply

Answer 2

Sep 23, 2008 5:22 PM in response to Andbrowny

That does not seem to resolve my issues.

Reply

Answer 3

MrHoffman

Level 10

159,153 points

Sep 23, 2008 6:50 PM in response to W. S. Wellington

Are you using a web proxy with your new firewall?

There's a [broken update tool|http://forums.macosxhints.com/showthread.php?t=79404] - read carefully, it's not labeled clearly - around.

There's also a [brute-force purge and restart|http://lists.apple.com/archives/macos-x-server/2006/Oct/msg00017.html] sequence.

Reply

Answer 4

Sep 24, 2008 7:49 AM in response to MrHoffman

I went for the brute-force method, but no joy. I still have blue exclamation marks next to my updates.

As I mentioned above, the server has un-proxied access to the internet on port 80. This should not be a proxy issue. It could however be a port issue. I could have a port blocked that Software Update uses.

Reply

Answer 5

Andbrowny

Level 4

1,614 points

Sep 24, 2008 12:02 PM in response to W. S. Wellington

Hi Bill, I'm not sure about the port SUS uses externally , could try 8088.
What results do you get if you enter sudo serveradmin status swupdate and sudo serveradmin settings swupdate
in terminal?
THe first on should return *swupdate:state = "RUNNING"*
and hopefully the second one should return a bunch of random text signiflying the downloads and give a status for each, especially the ones that haven't completed downloading.
Cheers
BTW can you access the default Apple SUS from a client?

Reply

Answer 6

Sep 24, 2008 1:02 PM in response to Andbrowny

Heh.. the firsd command returns the state "RUNNING"

the second command generated thousands of lines of seemingly random numbers. I tried to paste them in here, but that didn't work out so well... Too big I suppose

Yes... a client can access Apple's SUS site.

Bill

Reply

Answer 7

Sep 24, 2008 1:05 PM in response to Andbrowny

The server also has unlimited access over port 8088.

I want to tighten this and port 80 up... but currently they are wide open in hopes this can be resolved.

Reply

Answer 8

Andbrowny

Level 4

1,614 points

Sep 24, 2008 1:20 PM in response to W. S. Wellington

Ok, can you pipe the output of the settings command to a txt file and search it for incomplete download or something like that. it should be in a format like
*swupdate:lastChecktime = 2008-09-22 12:17:33 +1200*
swupdate:portToUse = 8088
swupdate:autoMirrorOnlyNew = no
swupdate:updateItemsRecordsArray: arrayindex:231:CFBundleName = "Xsan Admin Update"
swupdate:updateItemsRecordsArray: arrayindex:231:Description = <3c21444f 43545950 45206874 6d6c2050 55424c49 4320222d 2f2f5733 432f2f44 544429...*heaps more random numbers*
swupdate:updateItemsRecordsArray: arrayindex:231:IFPkgFlagRestartAction = "NoRestart"
swupdate:updateItemsRecordsArray: arrayindex:231:enable = yes
swupdate:updateItemsRecordsArray: arrayindex:231:CFBundleShortVersionString = "1.4.2"
swupdate:updateItemsRecordsArray: arrayindex:231:IFPkgFlagInstalledSize = 10239999
swupdate:updateItemsRecordsArray: arrayindex:231:mirror = "Mirrored"
swupdate:updateItemsRecordsArray: arrayindex:231:PostDate = "2007-10-19 08:59:28 +1300"
swupdate:updateItemsRecordsArray: arrayindex:231:ProductID = "061-3017"
swupdate:autoMirror = yes
swupdate:limitBandwidth = no
swupdate:valueBandwidth = 0
swupdate:checkError = no
swupdate:PurgeUnused = yes
swupdate:autoEnable = yes
see if any of them state they are incomplete, out of interest what are the latest entries in the SUS log?
Cheers

Reply

Answer 9

Sep 24, 2008 4:27 PM in response to Andbrowny

Yes... that is the format it follows.... and I have many that state IncompleteDownload.

And here are today's entries in the log

Wed Sep 24 05:19:04 norbert.aw.org swupd_syncd[7838] <Info>: Started
Wed Sep 24 05:20:46 norbert.aw.org swupd_syncd[7838] <Error>: Unable to download upstream catalog index (was looking for http://swscan.apple.com/content/meta/mirror-config-1.plist)
Wed Sep 24 07:43:30 norbert.aw.org swupd_syncd[9384] <Info>: Started
Wed Sep 24 07:44:48 norbert.aw.org swupd_syncd[9416] <Info>: Started
Wed Sep 24 08:02:51 norbert.aw.org swupd_syncd[9416] <Error>: Unable to download upstream catalog index (was looking for http://swscan.apple.com/content/meta/mirror-config-1.plist)

Reply

Answer 10

Andbrowny

Level 4

1,614 points

Sep 24, 2008 4:39 PM in response to W. S. Wellington

Looks to me as if there's a corrupt update there somewhere as suspected by MrHoffman. When you say you went for the brute-force method, what exactly did you do?
I'd be looking at removing/moving the /usr/share/swupd/html/ directory, if you haven't already, and starting afresh.
Cheers

Reply

Answer 11

Oct 16, 2008 7:51 AM in response to Andbrowny

This worked for me

Remote or go to the server terminal and type the following

serveradmin stop swupdate

you should get swupdate:state = "STOPPED" then type

serveradmin start swupdate

you should get swupdate:state = "RUNNING"

The GUI was the issue for us whether you ran it from the server or remotely.

Hope this helps.

Reply

Answer 12

Oct 21, 2008 3:58 PM in response to Andbrowny

so... removing that directory does no good. The software update page of Server Admin still shows the same things checked, and the same blue exclamation marks.

Essentially Apple's software update doesn't work out of the box. at least not on my server.

Reply

Answer 13

Oct 22, 2008 3:31 PM in response to W. S. Wellington

OK... Here is what I can tell.

OS X 10.5.x clients on my network can perform software update against Apples servers with no issue.

OS X Server 10.5.x can also perform software update against Apple's servers with no issue.

Some of my OS X 10.5.x clients are configured to look at my OS X server for their SW Updates. They show the server's name at the top of the update window, but report that there are no new updates.

Software update server (in Server Admin) makes absolutely no sense. There are a mish mash of copied updates (blue ball icon) and a mish mash of uncopied updates (gray ball icon) listed in the Updates tab.

If I click on a gray-ball and then click copy now, I get the little spinny fan thing for a few seconds and then nothing. The killer is that when I come back later, there is not a change in this window. What is gray now will be gray 10 years form now at this rate.

I have updates listed a recently as Quicktime 7.5.5 from 10/14/08 - so it's getting something from Apple, just not the software.

I have deleted folders of updates and other suggestions, but this stupid window always shows the same no matter what I do.

It seems to me that there is no way to start fresh.

Reply

Answer 14

Dec 2, 2008 2:42 PM in response to W. S. Wellington

In the end I needed to reinstall OS X server. All has been working well since then. Not an ideal fix, but it was the only thing to do according to the folks at Apple.

Reply

Answer 15

Dec 2, 2008 3:20 PM in response to W. S. Wellington

I am having this same problem that Wellington had:

OS X 10.5.x clients on my network can perform software update against Apples servers with no issue.

OS X Server 10.5.x can also perform software update against Apple's servers with no issue.

Some of my OS X 10.5.x clients are configured to look at my OS X server for their SW Updates. They show the server's name at the top of the update window, but report that there are no new updates.

I have the binded the client machine to the server using the "directory utility" and set up in Server Admin the machine via user and ethernet address to be fully managed for software updates. So, the client shows the servers IP in the update window, but does not find any new software ("All your software is up to date") even though when I look at the server, it shows all updates from Apple are copied and available for download.

I really hope I can get this going.

Reply