Software Update Server Updates automatically disabling

[Matt_Ellis]

I didn't have any luck on the apple forums. So im hoping to have more here.

I am currently setting up a Software Update server for my company and im having a strange issue. I enable all updates from 2103 - Current. They show as enabled and downloaded. But when i come in the next day all updates are disabled. has anyone ever seen this issue before?

System specs:
Mac Mini Late (2012)
OS X 10.10.5
Server app 5.0.4

Mac mini, OS X Yosemite (10.10.5), Server App 5.0.4

[yellow]

42 days uptime... my SUS automatically downloaded and hosted the latest patches.

[ssmurphy]

So still seeing the random switching of status for updates on the ASUS servers that had the issue when running OS X 10.11.3 and Server 5.0.15. Updating them to OS X 10.11.4 and Server 5.1 did not fix the issue for us.

No happy as we have 12 ASUS servers with half of them off line because we need to control Apple Software Update releases in our environment.

Anyone have a good resource for setting up a Reposado Server other then the source at https://github.com/wdas/reposado

Thinking of tips and tricks for setup, care and feeding.

thanks,

[Nix4Life]

here ya go:

Ubuntu:here
Centos:here. have used this one for past 4yrs. Keep the github link handy for any customizations

Good luck

Larry

[anix]

Finally! Paint me surprised, but somehow ASUS finally stopped disabling updates.

I have repeated the instructions I have mentioned in my previous post a few times since then (no other updates applied). And now, I think at the fourth attempt, the Software Update Service works as expected.

Although no software updates or configuration changes happened on the server, there are a few differences to my previous failed attempts:

1. After turning ASUS on again (mind: manual enabling and downloading), I have waited for around 24 hours with-out enabling or doing anything in the products list. Just let the server retrieve the complete list of updates.
2. Then I chose "Download & Enable" for only one of the recent products. Waited until it was downloaded and enabled, plus a few hours, where normally they get silently disabled. But the product was still enabled, so I repeated with a second product, and so on, but always waited for the current product to be downloaded and enabled, before issuing the command for the next product.
3. After a dozen products or so, I selected products to download & enable with-out waiting for each one to be downloaded & enabled first. However, I always selected a single product only per command. In my previous failed attempts I had selected multiple products at once.

This ASUS is now running for a few days and I have still all the products enabled (around 60 products). Normally, the server disabled all products after only a few hours. So this is definitely an improvement. I'm getting almost optimistic.

[Matt_Ellis]

Wish i could say the same official line from Apple engineering is some people are still having the issue. Needless to say when they asked me to reformat for the 10th time. I politely told them to pound sand. Ill spend my time setting up a reposado server instead of wasting it on fixing a 6 month old bug.

[dgreening]

Yeah... I am working on getting a Reposado test box up as well. Getting it running on Server.app 5.1 has been interesting so far.

[timtimtim]

Hi,

i'm having the same issue after installing 10.11.4 and Server 5.1.

Everytime I enable some updates, over time the get automatically disabled. When i look into the folder: /Library/Server/Software Update/Status/.pending the updates show up here: for example: .ticket_enable_031-53822.

I tried removing the files in the .pending folder. But that just disables the updates faster.

I have no problem i removing all the files and start over again in a weekend, but I read somewhere that that just means that more updates are getting disabled automatically.

Sure hope Apple fixes this problem fast.

[timtimtim]

I was just on the phone with Apple, I mentioned the incident number: 986233263 (from kish.jayson). The support guy said it was a known issue and that it was on the top of the priority list. I can see that there's a Beta (version 5.1.4) submitted: http://adcdownload.apple.com/OS_X_Server/OS_X_Server_5.1.4_beta/OS_X_Server_5.1.4_beta_Release_Notes.pdf

It only says: -bug fixes ..but one can always hope.

[dgreening]

Definitely still happening on 10.11.4/Server 5.1. Lets hope the 5.1.4 beta fixes it... 7 months later...

[timtimtim]

Yesterday a new beta update is released (together with 10.11.5 beta): OS X Server v5.1.4 beta 2.

[ssmurphy]

Saw that Beta today as well. Spinning up a test server with it now.

Will report back once Software Updates are synced and its had a few days to show if the auto enable/disable bug is still happening.

[ssmurphy]

Well that did not take long. On a fresh system with OS X 10.11.5 beta and Server5.1.4 Beta 2 still seeing the same issues as before.

Disable some of the software updates, come back a few hours later and they are re-enabled.

[spowell01]

We are seeing this exact same issue with our 10.11 SUS and have been for quite some time now. Worked with apple and they were never able to get us a fix of any sort.

[timtimtim]

The updates that gave me problems were the OS X El Capitan updates (031-53826, 031-53827 and 031-53822). It seems 2 out of three are nou enabled and stay that way. I downloaded and enabled 1 of them. I think part of a workaround is to have 1 action at once. I checked every time if the .pending (/Library/Server/Software Update/Status/.pending/) folder was empty before taking the next action. It seems to have worked for 2 of the updates.

My guess is that there's something going wrong with the deprecating updates, maybe even on the hosting servers from Apple itself. But that's just guessing...

[Over9000]

Still doesn't work for me with Server Update 5.1.5

[spowell01]

Still broken for us with the latest 10.11.5 and server updates as well. Apple actually sent me a new mac mini during our initial troubleshooting of this issue and of course it had the same issue as our original mini. They have pretty much stopped responding to my emails on this case as well. So i have our old mac and the new mac they sent me, and i guess i get to keep them both lol. Between the broken SUS issue and the broken NetRestore issue, i'm really getting the feeling that apple might be closer to just kicking their entire server product out the window.

[claven]

I ran our test script from Apple on Server 5.1.5 and it is still working to set and keep the updates enabled. They won't let me share it, but have them reference our case 976946712 to see if they will share it with others.

Curt

[dgreening]

Yeah, that script from Apple is working for us as well. SO ANNOYING!!!

[spowell01]

Thanks Claven i will see if i can get them to pass that script on to me

[hinrichd]

Does anyone know if the secret Apple script is now available for all?

[JCooper]

Hi all,

Having read the thread i'm having the same issues, just wondered if anyone else had seen this in the error logs?

May 24 10:29:03 ** com.apple.cts[61]: com.apple.periodic-monthly: scheduler_evaluate_activity told me to run this job; however, but the start time isn't for 2321179 seconds. Ignoring.

24/05/2016 09:09:25.882 swupd_syncd[22069]: download request received for unknown product (031-45690)

I'm seeing these errors when i click on a new update, doesnt matter what the update - mainly 10.11.2, the message always appears.

Any help appreciated.

[spowell01]

I don't believe the magic script is available publicly but after putting our attack dog on apple, he was able to get the script within a day. So far we are on day 1 of success which we haven't been able to obtain yet.

[Max_]

Hi , all!

I have a question for claven and dgreening.
Why you can't share this script with us? Is it a top secret information or something else?

[millersc]

Apple NDA is not something to mess with. I'm sure if they (Apple) finds the script working they will integrate or release it into the wild soon enough.

[dgreening]

Yeah, I'm not going to break our NDA...

It's kind of crazy that Apple has been providing this script for almost 6 months and has gone through 2ish releases of Server.app and has not yet been able to fix this issue in the product.

[Max_]

How you received this script? Do you have a special support from Apple (e.g. AppleCare OS Support)?
I've also called to them, but haven't received any information about workaround of the issue, only an advice to do it manually.

[dgreening]

I believe we have AppleCare Alliance. You can't just call Apple Support and get the script. They will probably have no idea what you are talking about...

[spowell01]

We have an applecare preferred support agreement. We also have apple reps almost monthly at our district that we do poke and prod to make cases progress quicker.

I think we all agree that we can't break the NDA regarding the script, but it is absolutely ridiculous that they haven't been able to bake this script fix into the final product.

[jameswaltrip]

If you are only using the Software Updates, I have found a fix by trashing the Server folder and setting up the Server app as a new setup. Trashing just the Software Updates doesn't fix it.
If you are using the Server app for other services, then I wouldn't do this.
Instructions below:
OS X 10.10.5 with Server 5.0.15 and also OS X 10.11.5 with Server 5.1.5
1) Turn off the Software Updates Service
2) Quit Server app
3) Find the Server folder in /Library and trash it. (Trashing just the Software Updates folder doesn't work)
4) Reboot and empty the trash.
5) Launch Server app (it will be a new Server setup)
6) Within Software Updates, Settings tab, Mode Manual (We manage our updates so no Automatic)
7) In Updates tab, do not check the Automatically Download Updates box, this is where I find the problem is.
8) Allow updates to download and show Available but do nothing until it has downloaded everything and do not run any terminal commands to sync or anything. This also caused a problem for me.
9) Once all the updates have downloaded and enable one and wait for it to finish, and move to the next one (Command R will Refresh). Enabling a bunch at once might cause an issue we but have not tested fully it.
As a test, enable one and check back after a few hours (I find 4 hours a good test point) and see if it stays Enabled. I have had success on three Mac Servers.
God luck!
James

[carlo_anselmi]

Hello everyone, I have the opposite behavior... can't disable/delete any update. Once downloaded, they ALL remain enabled.
Hope it will be fixed soon...
OS X 10.11.5 with Server 5.1.5
Cheers
Carlo

[ssmurphy]

Reading the Server 5.2 beta Release Notes points to this issue never being fixed.

Wonder if they will release a new tool to do this or are they going to force us to a third party solution? If its the latter, how long will that work before they stop working as well.

[dgreening]

Interesting. VERY INTERESTING. I wonder if they are planning of rolling ASUS into the Caching Server functionality...

[Over9000]

I just emailed the tech assigned to my case about the issue flat out asking about the depreciation and how we're supposed to handle managing updates in the future. I doubt i'll get a real response but would be nice to know what they plan on doing.

[Matt_Ellis]

Funny thing is at my new company, they have ASUS setup and up to date no issues. So strange how random the issue is. But yea sounds like it will be gone shortly.

[francksartori]

Did someone already take the time to test if the issue is solved with Server 5.1.7 ? I'm actually doing some testing.

[carlo_anselmi]

Same as my previous post, can't disable enabled updates. :-(
OSX 10.11.6 + Server 5.1.7
Cheers
Carlo

[timtimtim]

Hi,

it seems the problem is back again, after three months.

I downloaded the updates that I wanted on Friday, so by Monday they all had the status ‘Disabled’. I then put the Status on ‘Enabled’. It seemed that it was going allright, til a couple of hours later. The status for these updates were back to ‘disabled’ again.

The way I check it now:
If there are tickets in the /Library/Server/Software Update/Status/.pending folder I know that after a couple of hours the same thing happens.

We’ve tried it with 3 macs, even a freshly installed one.

[timtimtim]

Just a follow up:

i've installed Reposada and Margarita: https://clburlison.com/reposado-guide/ and i love it! It's an easy install en configuration (some basic linux knowledge is needed).

I encourage everybody to do the same.

[dliberti]

Hi All,
As mentioned above seems there is a discrepancy between the status reported within the Server GUI and the value contained "/Library/Server/Software Update/Status/com.apple.server.swupdate.plist" which is the plist loaded by the GUI to display the available patches. The com.apple.server.swupdate.plist has of course a direct dependency with the catalogs where all the informations are stored, so both of them have to be always synchronized. I'm testing a workaround which seems to work (at least till now) so I would like to share it, maybe some of you can test as well in order to have a valid response.

This is what I have done: 1. Quit Server.app
2. Open the Terminal
3. Stop the SWupdate Service -> sudo serveradmin stop swupdate
4. Change the status of a specific patch where 022-3271 is the patch ID (you can get the id by double-click on the patch in the GUI) and NO or YES is value to set (disabled or enabled) with the command ->
sudo /usr/libexec/PlistBuddy -c 'set workingSetProducts:022-3271:enable NO' /Library/Server/Software Update/Status/com.apple.server.swupdate.plist
5. Go to folder: /Library/Server/Software Update/html/ and remove all the catalogs and links EXCEPT the "content" folder
6. Go to folder: /Library/Server/Software Update/html/content/ and remove everything EXCEPT the "downloads" folder
7. Again in the Terminal run the synchronisation with the swapple server -> sudo swupd_syncd -sync
Note that the ASU service is still off and must be off.
8. At the end of the synchronisation, it will take some time to finish, start again the service -> sudo serveradmin start swupdate
9. Open Server.app and the patch should be correctly set.

Patches that have not yet been downloaded must be enabled directly by selecting "download and enable".
If you have to re-enable or re-disable patches this has to done following the same process above.
For those who are lazy like and in case of positive feedback, i'll putting together a script to enable/disable patches in a single shot.

please let me know if it works

[dliberti]

I've been able to workaround this issue. Solution has been posted but not published yet.