Troubleshooting tips for update issues in AppScan Standard

Technote (FAQ)


Question

How do you troubleshoot IBM Security AppScan Standard when problems are encountered while updating if Proxy Servers or Firewalls are preventing access to the updates server?

Answer

This technote gives some troubleshooting tips for issues with the update function. To see how the update process works, consult technote How the Update function works in AppScan Standard.


  1. Does the Update function use HTTP or HTTPS?
    The AppScan Standard updates connect using HTTP and HTTPS.


  2. InstallShield Windows Processes:

    AppScan Standard performs its updates using InstallShield. When AppScan Standard checks for updates, the following InstallShield processes are running in the background sending information to AppScanUpdates.exe:

       issch.exe (InstallShield Update Service Scheduler)
       agent.exe (InstallShield Update Service Agent)
       ISDM.exe (InstallShield Update Service Download Manager)

    These programs are located in the C:\ProgramData\FLEXnet\Connect\11 folder.

    If a personal firewall is present on the machine, these processes need to be allowed access to the Internet.


  3. Program Updates Applet using the Control Panel:

    If the Auto-Update process fails, one of the first steps to try is to navigate to the Windows Control Panel > Program Updates applet and attempt to download the AppScan Standard updates this way.

    That will show if AppScan Standard is not able to communicate with the update service properly or if the cause of the problem is the InstallShield service itself.


  4. AppScan Standard Update Servers:

    The first server contacted by the InstallShield Service is updates.installshield.com. The update service will download an XML file with the list of updates, the description and the location of the update files.

    After the list of updates is downloaded, InstallShield prompts for download confirmation. If confirmation is received, the agent.exe process launches the InstallShield Update Service Download Manager (ISDM.exe), which will connect to the IBM download server at download4.boulder.ibm.com and download2.boulder.ibm.com

    Please ensure there is access through Internet Explorer to the following server by accessing the link in Internet Explorer's browser:
  5. WCCP connections

    There have been cases where the Install Shield Update service fails on networks using the Web Cache Communication Protocol (WCCP).

    This situation is harder to troubleshoot since the Internet Explorer settings appear to specify a direct connection since the HTTP requests are intercepted by the router and redirected to the web cache. Very few browsers are currently compliant with this technology.

    One clue that can indicate that WCCP is in the picture is that Mozilla Firefox cannot connect to any external sites while Internet Explorer can connect just file although proxy settings are blank and identical between the two browsers.

    The solution is to manually specify the address of a proxy server on the network that is not using the WCCP service and make sure that Bypass proxy for local addresses is checked.


  6. User-Agents:

    The User-Agent header is added to the HTTP request by an application in order to identify itself to the Web Server. All InstallShield processes use their own User-Agent.

    There are two stages to the update process.
    1. The download of the update list by the agent.exe process, which uses the following User-Agent header: "ISUA 4.60" and "ISUA 12.00"
    2. The download of the update package by the IDSM.exe process, which sends all its requests using the following User-Agent header: "ISUSDownloader"

      Many proxies filter the HTTP traffic based on the User-Agent header. The Network Administrator would need to add the above two headers to the list of allowed User-Agents.

      Note: If Internet Explorer is able to access the download sites and there is no personal firewall involved, the problem is most likely caused by the InstallShield User-Agents being blocked by the proxy.


  7. InstallShield System Errors:

    The InstallShield services might become unregistered and fail to function properly. Here is a fix that re-registers all the Install Shield applications with the Operating System.
    1. Open a command prompt window (click Start > Run and type 'cmd')
    2. Change the directory to "C:\Program Files\Common Files\InstallShield\UpdateService" or "C:\ProgramData\FLEXnet\Connect\11" depending on the location of isdm.exe and agent.exe.
    3. Type "isdm.exe /regserver" and press Enter
    4. Type "agent.exe /regserver" and press Enter
    5. Change the directory to "C:\Windows\Downloaded Program Files". (On Windows 2000, this will be "C:\WinNT" instead of "C:\Windows".)
    6. Type "regsvr32.exe isusweb.dll" and press Enter


  8. As a workaround, product and Security Rules updates are available for manual download as described in Where to download Security Rules, FixPacks, releases of AppScan Standard.


Related information

Update function in AppScan Standard v 8.0

Document information


More support for:

IBM Security AppScan Standard
Installation: Update

Software version:

Version Independent

Operating system(s):

Windows

Reference #:

1283297

Modified date:

2015-06-25

Translate my page

Content navigation