Self Heal Applications

[sgoetz]

I was wondering if anyone on JAMF nation has something that will Self Heal an application when something goes wrong. Or if you guys have suggestions into what I can look at. Whether that be Casper Based or 3rd party.

Thanks

[bpavlov]

Since you asked....Filewave actually works by deploying what are called filesets. It basically allows you to manage software deployments at the file level and determine what can be modified and what shouldn't. If someone tries to for example update a web browser like Firefox, then Filewave will automatically overwrite (self-heal) the changes made to the Firefox.app (and its sub folders) assuming you set it up that way. It does this by comparing the checksum of the files deployed and what's on the computer. Every check-in it checks to make sure all files are in compliance.

There are of course many caveats with dealing with such a system and if you have a lot of software you will go nuts having to get so granular. You also have to package up software using Before and After snapshots if you decide to use this functionality which means you lose any logic that may be built-in the vendor's installer. They do support regular PKG deployments too, but it's not the main focus.

It's quite a different software deployment solution than most other products. There may also be a few other solutions out that. I forget what it was called but I think it may have been Puppet which I demoed quite a few years back at PSU MacAdmins Conference (2011?) in a lab session. I remember that any changes you made the software would go back to its original configuration. I could be wrong though and it may have been something else.

Lastly, there is Deep Freeze. I think you can get somewhat granular with what areas you freeze and what thawed spaces you want available. But I haven't used it in years. Perhaps someone can provide more feedback.

[nessts]

I think this is kind of like going to the mechanic and saying my car is squeaking can you tell me what to do to stop it. You would have to be way more specific about what you think would need to be self healed before you could even begin to delve into how to heal any one application and its likely not going to be the same for any two.
And what does self heal mean to you? the user cannot launch the app, or the user updated the app to an unapproved version?

[sgoetz]

It would be more like the user can no longer use the app, because it wont open, or because it freezes. and we are trying to make it so they dont' have to contact Help Desk to get it fixed. Our upper management is trying to go more to a User help themselves type scenerio and as automated as we can get. So just poking around on whats out there that we could possibly use to make our users lives easier.

[bpavlov]

Some of the options I pointed out are still viable of course because if a user does something the applications just self-heal as I mentioned. But that's quite drastic I think for what you're looking for. One thing you can do today and right now is make your installers available via Self Service and just point the users to re-install software. You could even include uninstall scripts or just build in the uninstall scripts into the installer you package via preinstall scripts if you wanted. Of course if something isn't working, I think users will (and rightfully so) always contact IT unless they like to muck around. I find most users are afraid of making things worse and will prefer to use help if they can get it. Your user base may be different though.

[nessts]

From where I stand and 8 years of helping people on Macs 99% of the time you do not need to re-install the software, its almost always, cache, preferences, saved application state, that affects an applications startup.

So, you could self heal this current Outlook 14.5.0 no main window problem fairly simply by deleting the preference file, killall cfprefsd, and relaunch. but that is only going to work for that one application.

I think all you need to do is take some simple shell scripting classes, look at the plethora of examples on this site, learn about defaults read and write, never forget the wonderful new preference daemon and you can self heal 99% of your common problems in 20 lines or less of a shell script. There are examples in here about getting scripts to run as the user, which 99% of the time is going to be the issue. Learn the difference about the difference between running things as root and as the user, and different Preference locations, User specific, User/host specific and system wide settings and you can do just about anything your heart desires. Also many will tell you that with Python or Perl you can do more and repeat it easier, but that just adds another level of programming.

So I personally thing @bpavlov is incorrect in saying make installers available. It wastes time, and in most cases will do nothing to solve the problem. Not that you might have to write a script to uninstall some software anyway like Office if you want to do it properly needs a script.

[mm2270]

I'm not sure if any of the mentioned solutions are really going to get you to what you're looking for. The problem is, how does the system know an application can't launch? If there are a bunch of critical files missing from the installation, then yes, it could detect this and self heal. But applications not launching or crashing may be due to a number of reasons, and can happen even if the application is fully intact on the system. As a simple example, the recent 14.5.0 Office update is breaking Outlook usability on Macs running 10.10.3 and up, but I can't think of any system in the world right now that would be able to detect and "heal" that situation. It can't possibly know that the app launches but due to bugs/incompatibility, the main Outlook window doesn't appear.

I know that's an extreme example, but it applies nonetheless. If you want something that repairs missing files only, then yeah there are systems that can do that. In fact, the Casper Suite had a self healing function built in the older versions for a while, although I never quite understood how it actually worked and never got a straight up answer on it from anyone whenever I asked. I don't think its in the product anymore (probably because no-one knew how to use it)

[bpavlov]

You could make whatever you want available via Self Service. Could be the installers, scripts to uninstall just the app, scripts to remove preferences, scripts to remove both the app and preferences and then re-install fresh built into a pkg, profiles, etc. For example if a user installed an unapproved version of certain software and they need to re-install the proper version then making just the installer available via Self Service would be helpful. It's going to vary by application and what you decide to make available available to them. I don't see how the installers are unhelpful if the goal is for users to help themselves. It's just one of the many ways they can help themselves.

You are right that bad preferences or bad caches do tend to be a problem, but it's not the issue a user may face or run into.

[bpavlov]

@mm2270 Filewave would definitely self heal in the situation you described with the recent Office update. If you got only Office 2011 14.4.9 deployed and a user manually installed 14.5.0 then at the next check-in the software would self heal based on your fileset. Not an extreme example at all as that's how granular it gets. It would literally replace all the files that have been changed back to the original files that the IT admin has deployed via Filewave.

I believe I spoke with a vendor 2 years ago at MacTech and when I mentioned that's what I was using at the time he said he was familiar with it and called it a surgical tool. Very powerful in what it could do, but that can go both ways if you make a wrong move a deploy the wrong file or have the wrong file self healing. With all that said, Filewave has its shortcomings (like any product).

[mm2270]

@bpavlov I'm somewhat familiar with FileWave, but what you're describing isn't exactly self healing. Its more like forced compliance. Basically, anything that goes "off" from what you have set as your standard gets "fixed". I can't recall if it can be set on a per application basis, but if not, that scenario could prove problematic if for example you allow users to upgrade browsers on their own. User installs the latest Firefox, or say, Chrome auto updates itself like its wont to do. It gets reset back to the FileWave set. Frustration ensues. That doesn't sound like something that would be easy to maintain over the long haul.
I'm not disparaging FileWave, because I understand that that type of compliance maintenance is powerful, but I happen to know there are many current Casper Suite customers that transitioned from FileWave installs because they found the way it worked to be too strict or complex. Just saying..

[bpavlov]

@mm2270 Filewave calls it self-healing. Maybe it's "fixing". Whatever you want to call it, you are right that it does take a lot of extra work. I wouldn't wish that kind of hell on anyone. You have to get really granular and you could easily just spend the majority of your time just repackaging apps. And it's really meant for an environment where users do not have admin access so users cannot update apps themselves. Anyways, I mentioned that particular feature in Filewave due to the thread topic. I wasn't looking to focus on anything else about the product. If someone test-drives it they can figure out whether a product works for them or not. I'm quite aware of the frustration you are speaking of with other admins who use the product. Suffice to say, I'm happy with Casper :)

[sgoetz]

lol thank you guys for all the input. You gave me some good ideas with teh scripting of removing preference files and caches. Sounds like going with Filewave or any product similiar to that really only restricts users to what is allowed. And in our environment everyone has admin access... Cries in corner* :P