-
Title
KACE SMA patch status showing as “downloading” -
Description
After a patch job runs multiple machines under the show all link of the patch schedule are showing the status of "downloading". This article also provides an explanation of patch download configuration section and how each of its options work.
-
Cause
- KACE SMA has to download those patch packages that were detected as needed (If using “Files detected as missing” – Security > Patch Management > Patch Download Settings)
- When the machines in question are running detect and deploy a patch or patches that were determined as necessary are not downloaded to the KACE SMA.
- This is a status message only not an error; however there a few items that need to be checked specially if patch task is stuck in downloading phase.
-
Resolution
1. Verify that Signature Status and Patch Files Status are showing updated
- Ensure that KACE SMA required ports and URL’s are available – Check Which network ports and URLs are required for the KACE K1000 appliance to function? (111775)
- Additional observations:
- If Signature Status shows as “Your patch subscription has expired. Please contact support for assistance” please check Error Message: Your patch subscription has expired. Please contact support for assistance. (146363)
- Or if Signature Status shows as “Importing metadata for Signatures” attempt manual patch download (Security > Patch Management > Patch Download Settings > Run Now), in case that status remain the same contact KACE Support for additional assistance.
2. Check that Patch download configuration is set as “All subscribed files” or “File detected as missing” and not as Disabled.
About Configure:
- Disabled: Prevent the downloading of patch packages. This prevention includes the installers that are required to install the patches.
- All subscribed files: Maintain a full cache of subscribed packages on your KACE SMA appliance. This option downloads all deployment packages to which you subscribe, without checking to determine whether they are required for your environment.
- Files detected as missing: Allow the appliance to determine which packages to download based on the results of Detect jobs.
3. Check that Signature and File schedule download are enabled (Using none prevent patch signatures to be downloaded)
About Schedule
- None: Prevent the downloading of patch signatures.
- Every __ hours: Download signatures at a specified interval. Use caution when specifying frequent intervals (4, 8 or 12 hours), because this can increase bandwidth requirements.
- Every day at the specified time: Select day to download patch detection signatures every day, or select a day of the week to download once a week.
Note: When setting up patch downloads, timing is important. The appliance activity log is created at 1:30, and maintenance tasks occur between 01:00 and 01:30. Quest recommends that you schedule patch downloads to occur after the log and maintenance tasks are complete, which is about 3:00.
- On the nth of every month or on a specific month at HH:MM: Select the day of the month to download patch detection signatures on a monthly basis.
- After signature download: Download packages after the signatures have been downloaded. This option is not available if package download is disabled in the Patch Download Options section.
- Every __ minutes/hours: Specify the frequency with which signatures and packages are downloaded. This option is available only if Patches detected as missing in the Patch Download Options section is selected.
Note: What to take in consideration when using “File Detected as missing” and how it operates along patch schedule download settings.
It's dependent on your Package Download schedule. Under Security > Patch Management > Patch Download Settings, you have options to either:
- Download packages after signature download
- Download at set intervals (Every __ minutes/hours). For example, every hour, 2 hours, etc.
Additional observations: While it is possible to set it to this, we do not recommend running the package download every 30 minutes. It will dependent on your patch scheduling and your network bandwidth. Every hour or more is the recommended setting for downloading throughout the day. You can also have it download the packages after your signature download as well.
If your schedule is in the 'Downloading' phase, either wait for the next Package Download (based on download schedule), or manually force a package download under Security > Patch Management > Patch Download Settings > Run Now.
4. Check “Blackout download” - Specify a time period during which patch detection signatures cannot be downloaded; the appliance stops patch downloads at the specified time.
5. Ensure on the patch schedule that Detect patch label is the same as the Deploy patch label.
6. Additional recommendations if using “File detected as missing”: Run a Detect only schedule the day before the normal patch schedule is ran, this will allow missing patches to be downloaded to the appliance for deployment.
If having issues with patches in downloading status after following the recommendations listed above, proceed downloading KACE SMA logs (Settings > Support > Retrieve Appliance Activity Logs - Under troubleshooting tools) and contact KACE Support for further assistance.