CiraConnected=False - Machine is turned ONLINE

[Jools86]

We now have 900 machines with Intel EMA installed, of those 900, 90 are displaying CIRA Not Connected, even though they are Online and I can ping them.

If I run a job to de-provision, and restart the EMAAgent, they normally come back as CIRA Connected once re-provisioned.

10% is a big number, why does this happen?

[MIGUEL_C_Intel]

Hi Jools86,

Please give me more details of the non-working machines.  I understand the issue is fixed after installing the EMA agent file with a Power Shell script.  

-Is the issue happening repeatedly on these endpoints after doing this troubleshooting? 

-Do you mind sending logs from a non-working machine and a working machine?  

-Please let us know if you are using the Admin or Client Control Mode.

-If you have admin mode, please tell us about the Certificate.  Review the Manageability Server and Swarm Server logs if you are getting any PKI issues.

We haven’t seen this issue before.

Regards,

Miguel C.

Intel Customer Support Technician

[Jools86]

This is a machine I troubleshooted last night, still not fixed (as it stands 15 of the 90 I remediated are still broken). My remediation steps are:

• De-provision AMT - ie. ACUConfig /Unconfigure
• Restart EMAAgent service

Agents are 1.11, machines are provisioned to Admin Control Mode using CIRA. Our provisioning Certificate used for the AMT profile is DigiCert and runs out June 24:

Broken Machine logs (attached  EMAAgent-broken):

Healthy Machine (attached EMAAgent) has same types of errors:

[Jools86]

I have just De-Provisioned and Restarted EMA-Agent on once of the machines that cannot be remediated.

I see the following errors in the Manageability Server logs when it is re-provisioning *(after the EMA Agent restarts):

AMT provisions using PKI fine (apart from those 2 errors), but we see the following when we try to connect to it:

Logs uploaded (EMAAGent-ErrorsduringPKI.log)

[MIGUEL_C_Intel]

Hi Jools86,

I found the following from the pictures provided.  The endpoint has Intel® Standard Manageability.  This option has limited features in comparison to Intel® Active Management Technology (Full Manageability). 

Out-of-band KVM remote control is not available.

The complete list of features for each type is in the article 000090499:

Differences between Intel® Active Management Technology (Intel® AMT) and Intel® Standard Manageability

https://www.intel.com/content/www/us/en/support/articles/000090499/technologies/intel-active-management-technology-intel-amt.html

If you are getting this issue with Full Manageability - Intel® Active Management Technology (AMT) machines, please send us the information below:

1-Run the swarm test and share the results:

Open a command line as Administrator in the endpoint.

Go to the default path \c:\Program Files\Intel\Ema Agent\

Run the command: emaagent.exe -swarmserver

2-Let us know if you have performed any changes on the server side; OS upgrade, or any similar.

The OS of the server might disable an older crypto cipher that is less secure and deprecated. 

Use the article 000093800 Intel® Active Management Technology (Intel® AMT) Version 14 and Later Not Working on Windows Server* 2022 for reference.

https://www.intel.com/content/www/us/en/support/articles/000093800/software/manageability-products.html

3-Please send us the most recent EMA Server logs, including EMAlog-Webserver.txt, EMAlog-Swarmserver.txt, EMAlog-Ajaxserver.txt, EMAlog-Recoveryserver.txt, and EMAlog-Manageabilityserver.txt.

Default Path:[System drive]\Program File(x86)\Intel\Platform Manager\EmaLogs

I will wait for your findings.

Regards,

Miguel C.

Intel Customer Support Technician

[Jools86]

Hi Miguel,

This happens on Full Manageability chips (I sent you a bad example).

Machine with the issue (Sent log as EMAAgent-FullManageability.log)

1. ema agent -Swarm server test results

2. Server OS is Windows Server 2019

3. I have uploaded latest server logs (the ZIP file)

[Jools86]

To resolve the above issue, the following works:

From EMA Console

On Machine

1. EMAagent.exe -fulluninstall
2. ACUconfig /unprovision
3. EMAagent.exe -fullinstall

I wait a few mins then it is fixed

So there is nothing stopping the machine from working, it seems like things get stuck, then a deletion of the EMA record for the machine followed by an new install fixes things.

[MIGUEL_C_Intel]

Hi Jools86,

I reviewed the logs and found an issue related to the client certificate chain.  Please try to fix the issue by reinstalling the EMA agent file (latest version) without doing the re-provisioning.

Regards,

Miguel C.

Intel Customer Support Technician

[Jools86]

Thanks Miguel. Will test this later on today. I have a change in to fix the now 19 machines with this issue.

[Jools86]

Hi Miguel,

Just reinstalling leaves us with:

[Jools86]

but if I do the following it works and CIRA is connected:

• Stop Managing Endpoint (From EMAConsole)
• Reinstall EMA Agent on machine "Emaagent -fullinstall"

Why does this happen, as it seems to occur on quite a lot of our machines, how do they get in this state?

[MIGUEL_C_Intel]

Hello, Jools86,

According to the steps performed; the endpoints were provisioned by a previous EMA instance.  Do you have duplicate endpoints in the current EMA instance?

Regards,

Miguel C.

Intel Customer Support Technician

[Jools86]

Hi Miguel,

We had another the Manageability service added on another server for a week (see another thread), this was disabled and manageability component removed a while back.

Does this mean I am right to de-provision and do the uninstall/install of the client agent?

Regards,

Julian

[MIGUEL_C_Intel]

Hello, Julian,

Yes, if the endpoints were previously provisioned by another EMA instance or any other application; it is necessary unprovisioning and provision them with the latest EMA agent file.  

In your case, with possible duplicate endpoints; Stop Managing, unprovisioning, and finally install the latest EMA agent file.

Regards,

Miguel C.

Intel Customer Support Technician

[MIGUEL_C_Intel]

Hello, Julian,

I am following up on the case and wondering if further assistance or confirmation from our side is necessary.

Your troubleshooting was correct.

Regards,

Miguel C.

Intel Customer Support Technician

[MIGUEL_C_Intel]

Hello, Julian,

I hope this post finds you well.

Do not hesitate to reply or create a new thread if further assistance is necessary. 

Regards,

Miguel C.

Intel Customer Support Technician

[Jools86]

Thanks Miguel, will keep an eye on them to see if any return to the CIRA not connected status.