Missing app not installing

[Leeham]

Hi all,

I've recently tried to reinstall the Meraki Systems Manager Agent onto any machines that it appears to be missing from, according to the Devices page, by clicking the Reinstall button within the individual machines record:

The result is then posted as a success:

However, the Devices page still shows "Agent installed? = No", and the app remains listed under the missing apps section

Any ideas what's going on here?

Thanks,

Liam

[beks88]

You'll need to check if the agent got installed and is running correctly

https://documentation.meraki.com/SM/Other_Topics/Systems_Manager_Logging_and_Troubleshooting#macOS

We had the same issue on some of our devices, which have been enrolled the manual way.

You need to use both enrollment methods from the Add devices -> macOS page, this solved our issue. Even reinstalling the agent should help, but remember you need also the profile installation from m.meraki.com

[Leeham]

Thanks @beks88, looks like I might be getting somewhere now. This is the tail of the /var/log/m_agent.log file on the machine I mentioned in my reply to RaPo above that is both reporting the agent installed and not installed:

2019-07-16 11:23:07.391494 [0x11ad7b5c0]: ClientManager::check_client_pulse(): client pcc202.meraki.com:993 timed out; restarting
sigusr1_handle
2019-07-16 11:23:08.483071 [0x700004c20000]: TunClient::main() [pcc202.meraki.com:993], starting up...
2019-07-16 11:23:08.996557 [0x700004c20000]: check_cert(): !SSL_get_verify_result()
2019-07-16 11:23:08.996628 [0x700004c20000]: TunClient::connect_to_proxy(): warning: check_cert returned false!
2019-07-16 11:23:17.372820 [0x700004c20000]: check_cert(): !SSL_get_verify_result()
2019-07-16 11:23:17.372966 [0x700004c20000]: TunClient::connect_to_proxy(): warning: check_cert returned false!
2019-07-16 11:23:33.532234 [0x700004c20000]: check_cert(): !SSL_get_verify_result()
2019-07-16 11:23:33.532307 [0x700004c20000]: TunClient::connect_to_proxy(): warning: check_cert returned false!
2019-07-16 11:24:05.318917 [0x700004c20000]: check_cert(): !SSL_get_verify_result()
2019-07-16 11:24:05.319002 [0x700004c20000]: TunClient::connect_to_proxy(): warning: check_cert returned false!
2019-07-16 11:25:08.185566 [0x700004c20000]: check_cert(): !SSL_get_verify_result()
2019-07-16 11:25:08.186006 [0x700004c20000]: TunClient::connect_to_proxy(): warning: check_cert returned false!
2019-07-16 11:25:15.883373 [0x11ad7b5c0]: ClientManager::check_client_pulse(): client pcc202.meraki.com:993 timed out; restarting
sigusr1_handle
2019-07-16 11:25:16.965132 [0x700004c20000]: TunClient::main() [pcc202.meraki.com:993], starting up...
2019-07-16 11:25:17.394005 [0x700004c20000]: check_cert(): !SSL_get_verify_result()
2019-07-16 11:25:17.394132 [0x700004c20000]: TunClient::connect_to_proxy(): warning: check_cert returned false!
2019-07-16 11:25:23.4946 [0x700004c20000]: check_cert(): !SSL_get_verify_result()
2019-07-16 11:25:23.5071 [0x700004c20000]: TunClient::connect_to_proxy(): warning: check_cert returned false!
2019-07-16 11:25:33.601899 [0x700004c20000]: check_cert(): !SSL_get_verify_result()
2019-07-16 11:25:33.602034 [0x700004c20000]: TunClient::connect_to_proxy(): warning: check_cert returned false!
2019-07-16 11:25:54.267066 [0x700004c20000]: check_cert(): !SSL_get_verify_result()
2019-07-16 11:25:54.267235 [0x700004c20000]: TunClient::connect_to_proxy(): warning: check_cert returned false!
2019-07-16 11:26:35.26616 [0x700004c20000]: check_cert(): !SSL_get_verify_result()
2019-07-16 11:26:35.26701 [0x700004c20000]: TunClient::connect_to_proxy(): warning: check_cert returned false!
2019-07-16 11:27:24.518008 [0x11ad7b5c0]: ClientManager::check_client_pulse(): client pcc202.meraki.com:993 timed out; restarting
sigusr1_handle

Any idea if these messages are anything to be concerned about?

[beks88]

I would recommend you to reach out to the support with the logs.

As mentioned above, we've been able to resolve our issue by installing the profile through m.meraki.com and additionally install the agent manually on the affected devices.

You could also try deleting the agent according to this docs

https://documentation.meraki.com/SM/Device_Enrollment/Uninstalling_Systems_Manager_and_Removing_Managed_Devices#macOS

and install it again.

Is your push cert valid? Otherwise I would reach out to the support for further troubleshooting.

[Leeham]

Good idea. I'll contact support and see what they say. Thanks!

Yep, our certificate is valid. I clicked on the Test Certificate button and it said so.

[Leeham · Accepted solution]

Hi all,

Just to tie this off, I contacted Meraki support and they had this to say:

I see that you're not using DEP and if you look at this article you'll notice this feature requires DEP:

https://documentation.meraki.com/SM/Device_Enrollment/Systems_Manager_Agent_and_MDM_Profile_Enrollment#Auto-installing_the_macOS_Agent

Pushing the app otherwise will not work. Per the KB: "Once configured, devices enrolling through DEP can automatically install the agent if within the specified scope."

I didn't realise DEP was a requirement so we will look into setting that up.

[beks88]

Yes, but as mentioned already above, if you install the agent manually, you can push apps either.

That's the point of a MDM, to push company apps even to devices enrolled as BYOD.

[Leeham]

Agreed. My problem is pushing out the agent, not pushing out additional apps. I suspect that once the agent is installed then I will be able to push out additional apps successfully as well.

[raj.yarlagadda@meraki.com]

@Leeham That success only means that a command has been sent by the MDM to install the app. If the app is still not being installed on the device. Please check if there is any firewall that is blocking the traffic. May even try a different Internet connection like a cellular hot spot to bypass the firewall and see if that will work.

[Leeham]

@raj.yarlagadda@meraki.com Ah, okay. That makes sense about the success of the command. Thanks for explaining that.

I have tethered one of the offending laptops to my mobile phone's internet connection, tried issuing the reinstall command and unfortunately not had any success. Agent installed? status is still No.

The only firewall running is the Mac's own internal firewall, which is incidentally enforced by the Meraki management profile.

Any other ideas?