Missing app not installing

[Leeham]

Hi all,

I've recently tried to reinstall the Meraki Systems Manager Agent onto any machines that it appears to be missing from, according to the Devices page, by clicking the Reinstall button within the individual machines record:

The result is then posted as a success:

However, the Devices page still shows "Agent installed? = No", and the app remains listed under the missing apps section

Any ideas what's going on here?

Thanks,

Liam

[kYutobi]

Have you tried re-enrolling device? How many devices fail?  

[Leeham]

Yes, all devices were re-enrolled recently.

18 devices are inaccurately reporting "Success" when attempting to reinstall the System Manager agent.

[kYutobi]

Hmm. That's odd. When you say SM Agent you do mean for desktop/laptop/mac installs correct? Not the iPad install? Usually when I install them on machines it would be through a m.meraki.com 

From there I install the agent. I never had to push it because it needed to get enrolled to recieve the ability for management. So I'm a little confused as to why it's being pushed. Sorry.

[Leeham]

Hi kYutobi,

When I say SM Agent, I mean the agent that can be installed onto devices (in our case MacBooks) alongside the Apple Profile as per step B on the Add Devices page regarding 

Enrolling both an agent and a profile enables all available functionality. An agent enables the ability to install software, remote desktop, view live stats (such as CPU utilization), and more. You can deploy the agent automatically on the Apps page by following these instructions.

So I'm attempting to follow the automatic deployment instructions, as advised.

Enrolling the device through m.meraki.com doesn't seem to install the SM Agent, just the Apple management profile.

Any ideas?

[SoCalRacer]

I believe apps don't auto approve when you add them. You many need to check the approval status and approve.

https://documentation.meraki.com/SM/Apps_and_Software/Deploying_Store_Apps_for_iOS%2F%2FmacOS_and_An...

[Leeham]

@SoCalRacer Hi.  That link you shared refers to Android apps requiring approval.  I'm working with Apple Macs.  Unless I'm mistaken, I don't see anything within the console related to approval when pushing apps to the macOS platform.  Let me know if this is not the case.

[SoCalRacer]

What version of macOS are you running on these agents?

[Leeham]

A mixture of versions across the 18 devices, including:

10.14.2

10.14.3

10.14.4

10.14.5

[vassallon]

@Leeham When you added the App to push out how did you set it up?

I selected the Meraki Systems Manager Agent from this screen and it installed correctly.

[Leeham]

@vassallon Hi.  Yes, I did the same.  Followed these instructions, to be exact: https://documentation.meraki.com/SM/Device_Enrollment/Systems_Manager_Agent_and_MDM_Profile_Enrollme...

Here's a screenshot showing the Systems Manager app in our list:

[RaPo]

Hi Leeham,

you do not use VPP assignment for Meraki App. Looks like you simply do not see the Question to allow app Installation.

do you use Apple DEP for enrollment? Or has anyone an own apple ID and Meraki is pushed like for BYOD?

[Leeham]

@RaPo Hi RaPo.  We do not use either VPP or DEP.  Our MacBooks all use the same shared Apple ID, managed by our IT department, so in theory, we are running a setup like BYOD.

[RaPo]

OK,

Have you already tested reenrollment using enrollment link (mail or SMS) or QR Code?

Systems Manager --> Devices --> Add Device --> iOS --> send enrollment link

[Leeham]

@RaPo Yes, we have tested re-enrollment on macOS devices using the link and QR Code.  Just to be clear, my problem is not with iOS devices, as you have outlined in your sequence.

Oddly, I now have a device which is saying "Yes" in the Agent Installed? column, bit still shows it as missing in the missing apps section (see attached images)

[beks88]

You'll need to check if the agent got installed and is running correctly

https://documentation.meraki.com/SM/Other_Topics/Systems_Manager_Logging_and_Troubleshooting#macOS

We had the same issue on some of our devices, which have been enrolled the manual way.

You need to use both enrollment methods from the Add devices -> macOS page, this solved our issue. Even reinstalling the agent should help, but remember you need also the profile installation from m.meraki.com

[Leeham]

Thanks @beks88, looks like I might be getting somewhere now.  This is the tail of the /var/log/m_agent.log file on the machine I mentioned in my reply to RaPo above that is both reporting the agent installed and not installed:

2019-07-16 11:23:07.391494 [0x11ad7b5c0]: ClientManager::check_client_pulse(): client pcc202.meraki.com:993 timed out; restarting
sigusr1_handle
2019-07-16 11:23:08.483071 [0x700004c20000]: TunClient::main() [pcc202.meraki.com:993], starting up...
2019-07-16 11:23:08.996557 [0x700004c20000]: check_cert(): !SSL_get_verify_result()
2019-07-16 11:23:08.996628 [0x700004c20000]: TunClient::connect_to_proxy(): warning: check_cert returned false!
2019-07-16 11:23:17.372820 [0x700004c20000]: check_cert(): !SSL_get_verify_result()
2019-07-16 11:23:17.372966 [0x700004c20000]: TunClient::connect_to_proxy(): warning: check_cert returned false!
2019-07-16 11:23:33.532234 [0x700004c20000]: check_cert(): !SSL_get_verify_result()
2019-07-16 11:23:33.532307 [0x700004c20000]: TunClient::connect_to_proxy(): warning: check_cert returned false!
2019-07-16 11:24:05.318917 [0x700004c20000]: check_cert(): !SSL_get_verify_result()
2019-07-16 11:24:05.319002 [0x700004c20000]: TunClient::connect_to_proxy(): warning: check_cert returned false!
2019-07-16 11:25:08.185566 [0x700004c20000]: check_cert(): !SSL_get_verify_result()
2019-07-16 11:25:08.186006 [0x700004c20000]: TunClient::connect_to_proxy(): warning: check_cert returned false!
2019-07-16 11:25:15.883373 [0x11ad7b5c0]: ClientManager::check_client_pulse(): client pcc202.meraki.com:993 timed out; restarting
sigusr1_handle
2019-07-16 11:25:16.965132 [0x700004c20000]: TunClient::main() [pcc202.meraki.com:993], starting up...
2019-07-16 11:25:17.394005 [0x700004c20000]: check_cert(): !SSL_get_verify_result()
2019-07-16 11:25:17.394132 [0x700004c20000]: TunClient::connect_to_proxy(): warning: check_cert returned false!
2019-07-16 11:25:23.4946 [0x700004c20000]: check_cert(): !SSL_get_verify_result()
2019-07-16 11:25:23.5071 [0x700004c20000]: TunClient::connect_to_proxy(): warning: check_cert returned false!
2019-07-16 11:25:33.601899 [0x700004c20000]: check_cert(): !SSL_get_verify_result()
2019-07-16 11:25:33.602034 [0x700004c20000]: TunClient::connect_to_proxy(): warning: check_cert returned false!
2019-07-16 11:25:54.267066 [0x700004c20000]: check_cert(): !SSL_get_verify_result()
2019-07-16 11:25:54.267235 [0x700004c20000]: TunClient::connect_to_proxy(): warning: check_cert returned false!
2019-07-16 11:26:35.26616 [0x700004c20000]: check_cert(): !SSL_get_verify_result()
2019-07-16 11:26:35.26701 [0x700004c20000]: TunClient::connect_to_proxy(): warning: check_cert returned false!
2019-07-16 11:27:24.518008 [0x11ad7b5c0]: ClientManager::check_client_pulse(): client pcc202.meraki.com:993 timed out; restarting
sigusr1_handle

Any idea if these messages are anything to be concerned about?

[beks88]

I would recommend you to reach out to the support with the logs.

As mentioned above, we've been able to resolve our issue by installing the profile through m.meraki.com and additionally install the agent manually on the affected devices.

You could also try deleting the agent according to this docs

https://documentation.meraki.com/SM/Device_Enrollment/Uninstalling_Systems_Manager_and_Removing_Mana...

and install it again.

Is your push cert valid? Otherwise I would reach out to the support for further troubleshooting.

[Leeham]

Good idea.  I'll contact support and see what they say.  Thanks!

Yep, our certificate is valid.  I clicked on the Test Certificate button and it said so.

[Leeham · Accepted solution]

Hi all,

Just to tie this off, I contacted Meraki support and they had this to say:

I see that you're not using DEP and if you look at this article you'll notice this feature requires DEP:

https://documentation.meraki.com/SM/Device_Enrollment/Systems_Manager_Agent_and_MDM_Profile_Enrollme...

Pushing the app otherwise will not work. Per the KB: "Once configured, devices enrolling through DEP can automatically install the agent if within the specified scope."

I didn't realise DEP was a requirement so we will look into setting that up.

[beks88]

Yes, but as mentioned already above, if you install the agent manually, you can push apps either.

That's the point of a MDM, to push company apps even to devices enrolled as BYOD.

[Leeham]

Agreed.  My problem is pushing out the agent, not pushing out additional apps.  I suspect that once the agent is installed then I will be able to push out additional apps successfully as well.

[Raj66]

@Leeham That success only means that a command has been sent by the MDM to install the app. If the app is still not being installed on the device. Please check if there is any firewall that is blocking the traffic. May even try a different Internet connection like a cellular hot spot to bypass the firewall and see if that will work.

[Leeham]

@Raj66 Ah, okay.  That makes sense about the success of the command.  Thanks for explaining that.

I have tethered one of the offending laptops to my mobile phone's internet connection, tried issuing the reinstall command and unfortunately not had any success.  Agent installed? status is still No.

The only firewall running is the Mac's own internal firewall, which is incidentally enforced by the Meraki management profile.

Any other ideas?