Intel vPro® Platform
Intel Manageability Forum for Intel® EMA, AMT, SCS & Manageability Commander
2881 Discussions

CiraConnected=False - Machine is turned ONLINE

Jools86
New Contributor II
2,006 Views

We now have 900 machines with Intel EMA installed, of those 900, 90 are displaying CIRA Not Connected, even though they are Online and I can ping them.

 

If I run a job to de-provision, and restart the EMAAgent, they normally come back as CIRA Connected once re-provisioned.

 

10% is a big number, why does this happen?

0 Kudos
16 Replies
MIGUEL_C_Intel
Moderator
1,988 Views

Hi Jools86,


Please give me more details of the non-working machines.  I understand the issue is fixed after installing the EMA agent file with a Power Shell script.  


-Is the issue happening repeatedly on these endpoints after doing this troubleshooting? 

-Do you mind sending logs from a non-working machine and a working machine?  

-Please let us know if you are using the Admin or Client Control Mode.

-If you have admin mode, please tell us about the Certificate.  Review the Manageability Server and Swarm Server logs if you are getting any PKI issues.


We haven’t seen this issue before.


Regards,

Miguel C.

Intel Customer Support Technician


0 Kudos
Jools86
New Contributor II
1,975 Views

This is a machine I troubleshooted last night, still not fixed (as it stands 15 of the 90 I remediated are still broken). My remediation steps are:

 

  • De-provision AMT - ie. ACUConfig /Unconfigure
  • Restart EMAAgent service

 

Agents are 1.11, machines are provisioned to Admin Control Mode using CIRA. Our provisioning Certificate used for the AMT profile is DigiCert and runs out June 24:

Jools86_2-1691744857324.png

 

 

Broken Machine logs (attached  EMAAgent-broken):

Jools86_0-1691744536213.png

Healthy Machine (attached EMAAgent) has same types of errors:

Jools86_1-1691744669689.png

 

0 Kudos
Jools86
New Contributor II
1,967 Views

I have just De-Provisioned and Restarted EMA-Agent on once of the machines that cannot be remediated.

 

I see the following errors in the Manageability Server logs when it is re-provisioning *(after the EMA Agent restarts):

 

Jools86_0-1691764044863.png

Jools86_1-1691764054430.png

 

AMT provisions using PKI fine (apart from those 2 errors), but we see the following when we try to connect to it:

Jools86_3-1691764143620.png

 

Jools86_2-1691764124874.png

 

Logs uploaded (EMAAGent-ErrorsduringPKI.log)

 

0 Kudos
MIGUEL_C_Intel
Moderator
1,944 Views

Hi Jools86,


I found the following from the pictures provided.  The endpoint has Intel® Standard Manageability.  This option has limited features in comparison to Intel® Active Management Technology (Full Manageability). 


Out-of-band KVM remote control is not available.


The complete list of features for each type is in the article 000090499:

Differences between Intel® Active Management Technology (Intel® AMT) and Intel® Standard Manageability

https://www.intel.com/content/www/us/en/support/articles/000090499/technologies/intel-active-management-technology-intel-amt.html


If you are getting this issue with Full Manageability - Intel® Active Management Technology (AMT) machines, please send us the information below:


1-Run the swarm test and share the results:

Open a command line as Administrator in the endpoint.

Go to the default path \c:\Program Files\Intel\Ema Agent\

Run the command: emaagent.exe -swarmserver


2-Let us know if you have performed any changes on the server side; OS upgrade, or any similar.

The OS of the server might disable an older crypto cipher that is less secure and deprecated. 

Use the article 000093800 Intel® Active Management Technology (Intel® AMT) Version 14 and Later Not Working on Windows Server* 2022 for reference.

https://www.intel.com/content/www/us/en/support/articles/000093800/software/manageability-products.html


3-Please send us the most recent EMA Server logs, including EMAlog-Webserver.txt, EMAlog-Swarmserver.txt, EMAlog-Ajaxserver.txt, EMAlog-Recoveryserver.txt, and EMAlog-Manageabilityserver.txt.

Default Path:[System drive]\Program File(x86)\Intel\Platform Manager\EmaLogs


I will wait for your findings.


Regards,

Miguel C.

Intel Customer Support Technician


0 Kudos
Jools86
New Contributor II
1,903 Views

Hi Miguel,

 

This happens on Full Manageability chips (I sent you a bad example).

 

Machine with the issue (Sent log as EMAAgent-FullManageability.log)

Jools86_1-1692014491323.png

 

1. ema agent -Swarm server test results

Jools86_0-1692014466431.png

2. Server OS is Windows Server 2019

Jools86_2-1692014686729.png

 

3. I have uploaded latest server logs (the ZIP file)

 

 

 

0 Kudos
Jools86
New Contributor II
1,899 Views

To resolve the above issue, the following works:

From EMA Console

Jools86_3-1692015176710.png

 

On Machine

  1. EMAagent.exe -fulluninstall
  2. ACUconfig /unprovision
  3. EMAagent.exe -fullinstall

 

I wait a few mins then it is fixed

Jools86_4-1692017553690.png

 

So there is nothing stopping the machine from working, it seems like things get stuck, then a deletion of the EMA record for the machine followed by an new install fixes things.

 

 

0 Kudos
MIGUEL_C_Intel
Moderator
1,887 Views

Hi Jools86,


I reviewed the logs and found an issue related to the client certificate chain.  Please try to fix the issue by reinstalling the EMA agent file (latest version) without doing the re-provisioning.


Regards,

Miguel C.

Intel Customer Support Technician


0 Kudos
Jools86
New Contributor II
1,883 Views

Thanks Miguel. Will test this later on today. I have a change in to fix the now 19 machines with this issue.

 

0 Kudos
Jools86
New Contributor II
1,874 Views

Hi Miguel,

 

Just reinstalling leaves us with:

 

Jools86_0-1692031786491.png

 

 

 

0 Kudos
Jools86
New Contributor II
1,872 Views

but if I do the following it works and CIRA is connected:

  • Stop Managing Endpoint (From EMAConsole)
  • Reinstall EMA Agent on machine "Emaagent -fullinstall"

 

Why does this happen, as it seems to occur on quite a lot of our machines, how do they get in this state?

0 Kudos
MIGUEL_C_Intel
Moderator
1,864 Views

Hello, Jools86,


According to the steps performed; the endpoints were provisioned by a previous EMA instance.  Do you have duplicate endpoints in the current EMA instance?


Regards,

Miguel C.

Intel Customer Support Technician


0 Kudos
Jools86
New Contributor II
1,838 Views

Hi Miguel,

 

We had another the Manageability service added on another server for a week (see another thread), this was disabled and manageability component removed a while back.

 

Does this mean I am right to de-provision and do the uninstall/install of the client agent?

 

Regards,

 

Julian

0 Kudos
MIGUEL_C_Intel
Moderator
1,830 Views

Hello, Julian,


Yes, if the endpoints were previously provisioned by another EMA instance or any other application; it is necessary unprovisioning and provision them with the latest EMA agent file.  


In your case, with possible duplicate endpoints; Stop Managing, unprovisioning, and finally install the latest EMA agent file.


Regards,

Miguel C.

Intel Customer Support Technician


0 Kudos
MIGUEL_C_Intel
Moderator
1,772 Views

Hello, Julian,


I am following up on the case and wondering if further assistance or confirmation from our side is necessary.


Your troubleshooting was correct.


Regards,

Miguel C.

Intel Customer Support Technician


0 Kudos
MIGUEL_C_Intel
Moderator
1,734 Views

Hello, Julian,


I hope this post finds you well.


Do not hesitate to reply or create a new thread if further assistance is necessary. 


Regards,

Miguel C.

Intel Customer Support Technician


0 Kudos
Jools86
New Contributor II
1,584 Views

Thanks Miguel, will keep an eye on them to see if any return to the CIRA not connected status.

0 Kudos
Reply