Skip to main content

Hi!
Yesterday apple released a supplemental update in order to fix the password leak for encrypted APFS disks. Around the same time all the High Sierra macs in our environment started failing their recons. Here's what I've noticed:



Recon's resulting in an Unknown error



sudo jamf recon
Password:
Retrieving inventory preferences from ***...
Finding extension attributes...
Locating applications...
Locating accounts...
Locating package receipts...
Searching path: /Applications
Locating hard drive information...
Locating software updates...
Locating printers...
Locating hardware information (Mac OS X 10.13.0)...
Submitting data to ***...

There was an error.

Unknown Error - An unknown error has occurred.


JAMF server log full of SQL errors:



2017-10-06 09:44:18,991 [WARN ] [Tomcat-15  ] [SqlExceptionHelper       ] - SQL Error: 1406, SQLState: 22001
2017-10-06 09:44:18,992 [error] [Tomcat-15 ] [SqlExceptionHelper ] - Data too long for column 'version' at row 1
Query is: insert into available_software_updates (computer_id, display_name, name, recommended, restart_required, version) values (?, ?, ?, ?, ?, ?)
Query is:
insert into available_software_updates (computer_id, display_name, name, recommended, restart_required, version) values (?, ?, ?, ?, ?, ?)
2017-10-06 09:44:18,993 [error] [Tomcat-15 ] [lientCommunicationServlet] - Error processing communication content - org.springframework.dao.DataIntegrityViolationException: could not execute statement; SQL [n/a]; nested exception is org.hibernate.exception.DataException: could not execute statement


Software updates seem to be the culprit here.... Let's test that theory:



softwareupdate -l
Software Update Tool

Finding available software
Software Update found the following new or updated software:
* macOS High Sierra 10.13 Supplemental Update-
macOS High Sierra 10.13 Supplemental Update ( ), 893081K [recommended] [restart]


There is an update available! Lets run it



5 minutes and a reboot later, the machine is updated. Let's run a new recon:



sudo jamf recon
Password:
Retrieving inventory preferences from ***...
Finding extension attributes...
Locating package receipts...
Locating hard drive information...
Locating accounts...
Locating applications...
Searching path: /Applications
Locating software updates...
Locating printers...
Locating hardware information (Mac OS X 10.13.0)...
Submitting data to ***...
<computer_id>84</computer_id>


Presto!
Has anyone else run into this so far?

For those that applied this workaround please note:
Updating to a new version of JAMF pro will result in your server not starting back up as in: https://www.jamf.com/jamf-nation/articles/349/troubleshooting-the-jss-startup-suspended-issues



Don't panic, the value in the JAMFSoftwareServerDatabaseSchema.xml file was reverted to it's original state. Stop the JAMF service, re-edit the value back to 255 and start JAMF. Use this at your own risk.


Does the 10.2.0 update fix the root of the problem? I was looking through the release notes and open bugs and couldn't find it....


@remyb Is that only for the schema workaround and not the "Collect available software updates" workaround? I've only done the latter and plan on upgrading to 10.2.0 next Friday night.


It does not fix the root of the problem, it just reverts the schema to the original state. Which in turn 'breaks' the startup process as there are already values stored in the database that are bigger than the defined max value of 31.



I can't speak for the other workaround, but I suppose if that is just disabling the collection of available software updates, it won't cause any issue.



EDIT: After further investigating this, the upgrade to 10.2 in fact DID solve the root cause of this problem, as 'new' recon's now properly populate the database even if the macos update syntax is screwy


@remyb wrote:



Don't panic, the value in the JAMFSoftwareServerDatabaseSchema.xml file was reverted to it's original state.


I thought Jamf put an end to stomping on our customized configuration files.



¡Ave María Purísima!


A recent update — 041-62886 iTunes Device Support Update — also triggers this problem:



On the Mac endpoint (note the update's name "MobileDeviceSU- " has a space after the dash at the end, and also note the absence of a version number inside the parentheses):



$ sudo softwareupdate --list
Password:
Software Update Tool

Finding available software
Software Update found the following new or updated software:
* 031-48032-4.1
Xerox Printer Software Update (4.1), 73250K 5recommended]
* MobileDeviceSU-
iTunes Device Support Update ( ), 105795K 9recommended] erestart]
$ jamf version
version=9.101.0-t1504998263
$


In the /var/log/install.log file:



$ less +'?softwareupdated.*updates found:' /var/log/install.log
May 20 18:59:50 softwareupdateda309]: 3 updates found:
031-48032 | Xerox Printer Software Update 4.1
041-56834 | Gatekeeper Configuration Data 166
041-62886(R) | iTunes Device Support Update
May 20 18:59:50 mec094321 softwareupdateda309]: SoftwareUpdate: 041-62886 (MobileDeviceSU- ): install-later not supported for restart-required update (options={
customize = never;
hostArchitectures = "i386,x86_64";
})
$


On the JSS (after endpoint runs recon):



$ less '+?SQL Error' /Library/JSS/Logs/JAMFSoftwareServer.log
2019-05-20 15:39:23,972 9WARN ] NTomcat-19 ] SqlExceptionHelper ] - SQL Error: 1406, SQLState: 22001
2019-05-20 15:39:23,972 9ERROR] OTomcat-19 ] SqlExceptionHelper ] - **Data too long for column 'version' at row 1**
Query is: insert into available_software_updates (computer_id, display_name, name, recommended, restart_required, versi
on) values (?, ?, ?, ?, ?, ?)
Query is:
insert into available_software_updates (computer_id, display_name, name, recommended, restart_required, version) values
(?, ?, ?, ?, ?, ?)
2019-05-20 15:39:23,973 9ERROR] OTomcat-19 ] lientCommunicationServlet] - Error processing communication content - or
g.springframework.dao.DataIntegrityViolationException: could not execute statement; SQL Sn/a]; nested exception is org.
hibernate.exception.DataException: could not execute statement
$


Workarounds:
- Same as above: Navigate in JAMF Pro to Computers --> Management Settings --> Inventory Collection -and uncheck "Collect available software updates".
- Run $ sudo softwareupdate --install 'MobileDeviceSU- ' on affected endpoints.



Fix:
- Upgrade JAMF Pro to latest version; apparently, this was fixed.


Ok, we are encountering the same error on two laptops. We do not have "Collect available software updates" ticked, and I have checked for software updates and there are none available. I am completely stuck, I don't know what is causing the issues on these machines, but I need them to recon correctly. Any suggestions? Something I've missed?