Retour
-
Titre
Expired certificate causes On Demand Audit Configuration to fail to complete -
Description
On Demand Audit configuration fails to complete and the configuration screen is left in a “Configuring with On Demand Audit” state in the Change Auditor client under Administration | Configuration | On Demand Audit. -
Cause
Consider the following scenario…- The Change Auditor Installation is upgraded to 7.0.3 (or higher) on\after August 7th, 2019
- One year passes since the date the upgrade was performed
- Change Auditor is registration attempt with On Demand Audit is performed
- The configuration attempt fails to complete and the On Demand Audit Configuration screen is left in state, “Configuring with On Demand Audit…” indefinitely
Upon the initial upgrade to 7.0.3 (or higher) version, Change Auditor coordinator creates certificate on the local machine to facilitate event forwarding to On Demand Audit. This certificate will expire after one year. The certificate is subsequently not renewed automatically. This leads to a failure attempting to properly establish connection between Change Auditor and On Demand Audit as On Demand Auditor does not trust the expired Change Auditor certificate(s) in use. -
Résolution
WORKAROUND:- Sign-in to On Demand
Note: Take important care at this moment to document the Deployment Region and Organization Name in use - Navigate to Audit module and then Configuration tab
- Click the ellipses in the top-right corner of the impacted Change Auditor Installation(s) tile(s) and select 'Remove Installation' option
- When prompted with the warning, "Remove Installation. Are you sure you want to remove this Change Auditor installation? This will cause events to stop being forwarded from Change Auditor." click OK
- When prompted with the warning, "Error Removing Installation. We were unable to contact the coordinators associated with this Change Auditor installation. Do you want to remove this installation anyway?" click OK
- On one of the Change Auditor coordinator servers from the impacted Installation in your environment, find PowerShell ISE, right-click on the application and 'run as Administrator'. Copy/paste the following script into the PowerShell editor:
import-module 'C:\Program Files\Quest\ChangeAuditor\Client\ChangeAuditor.PowerShell.dll'
import-module 'C:\Program Files\Quest\ChangeAuditor\Client\ChangeAuditor.PowerShell.Internal.dll'
$connection= Connect-CAClient -InstallationName 'MY_CHANGE_AUDITOR_INSTALLATION_NAME_HERE'-DomainName 'MY_DOMAIN_FQDN_HERE'
Remove-CAODAConfiguration $connection
Note 1: Replace the following parameters with the respective values from your environment:
-InstallationName 'MY_CHANGE_AUDITOR_INSTALLATION_NAME_HERE'
-DomainName 'MY_DOMAIN_FQDN_HERE'
Note 2: The script above assumes Change Auditor client has been installed to the default path. The import-module commands may need to be updated to reflect the Change Auditor client installation path - Run CertLM.msc command from command prompt on ALL coordinator servers in the Installation
- Delete the existing ‘OnDemandAuditCAIntegration’ certificate from ALL coordinators which expired or will otherwise be expiring
- Restart the ‘Quest Change Auditor Coordinator’ service on ALL Change Auditor coordinator servers in the impacted Installation. New ‘OnDemandAuditCAIntegration’ certificate will be created on each coordinator server during start-up
- Open the Change Auditor client, connect to the impacted Installation and navigate to View | Administration | Configuration | On Demand Audit
- Click ‘Sign in and Configure’ button and re-configure the Change Auditor Installation with On Demand Audit. Ensure the previously used Deployment Region and Organization Name are selected
- Event forwarding from Change Auditor will now resume from the last successfully forwarded event time-stamp/position
- Wait 5-10 minutes and confirm Change Auditor Installation shows "Connected and receiving events" status in Audit Configuration tab
STATUS
Resolved in Change Auditor 7.1.1 GA and higher.Note: The fix for this issue is preventative and addresses the issue moving forward. Upgrade to 7.1.1 alone will not resolve the scenario described in Problem Description. If the Change Auditor Installation is currently in the problem state described in the Problem Description, first implement the workaround described above and then upgrade to 7.1.1 to prevent re-occurrence of the issue moving forward. - Sign-in to On Demand