Complinace update fails

[porettoa]

Hello,

We upgrade our visors to 7.0.3 Build 18644231. I now have 3 compliance updates that fail with "The host returns esxupdate error codes: -1. Check the Lifecycle Manager log files and esxupdate log files for more details." 

Also, since upgrading to vCenter to 7.03, my ESXi sever will not join the HA cluster, They keep trying to reconfigure over and over. 

Nedd help to resolve - Thank you!

Log  file for update:

2021-10-06T15:54:28Z esxupdate: 2101293: Transaction: INFO: Final list of VIBs being installed:
2021-10-06T15:54:28Z esxupdate: 2101293: esxupdate: ERROR: An unexpected exception was caught:
2021-10-06T15:54:28Z esxupdate: 2101293: esxupdate: ERROR: Traceback (most recent call last):
2021-10-06T15:54:28Z esxupdate: 2101293: esxupdate: ERROR: File "/usr/sbin/esxupdate", line 216, in main
2021-10-06T15:54:28Z esxupdate: 2101293: esxupdate: ERROR: cmd.Run()
2021-10-06T15:54:28Z esxupdate: 2101293: esxupdate: ERROR: File "/lib64/python3.8/site-packages/vmware/esx5update/Cmdline.py", line 153, in Run
2021-10-06T15:54:28Z esxupdate: 2101293: esxupdate: ERROR: File "/lib64/python3.8/site-packages/vmware/esximage/Transaction.py", line 965, in InstallVibsFromSources
2021-10-06T15:54:28Z esxupdate: 2101293: esxupdate: ERROR: inst, removed, exitstate = self._installVibs(curprofile,
2021-10-06T15:54:28Z esxupdate: 2101293: esxupdate: ERROR: File "/lib64/python3.8/site-packages/vmware/esximage/Transaction.py", line 1207, in _installVibs
2021-10-06T15:54:28Z esxupdate: 2101293: esxupdate: ERROR: hasConfigDowngrade = checkFdmConfigDowngrade(curProfile, newProfile)
2021-10-06T15:54:28Z esxupdate: 2101293: esxupdate: ERROR: File "/lib64/python3.8/site-packages/vmware/esximage/Transaction.py", line 1122, in checkFdmConfigDowngrade
2021-10-06T15:54:28Z esxupdate: 2101293: esxupdate: ERROR: compDowngrades = curProfile.GetCompsDowngradeInfo(newProfile)
2021-10-06T15:54:28Z esxupdate: 2101293: esxupdate: ERROR: File "/lib64/python3.8/site-packages/vmware/esximage/ImageProfile.py", line 2416, in GetCompsDowngradeInfo
2021-10-06T15:54:28Z esxupdate: 2101293: esxupdate: ERROR: curComp = self.components.GetComponent(name)
2021-10-06T15:54:28Z esxupdate: 2101293: esxupdate: ERROR: File "/lib64/python3.8/site-packages/vmware/esximage/Bulletin.py", line 1276, in GetComponent
2021-10-06T15:54:28Z esxupdate: 2101293: esxupdate: ERROR: raise ValueError('Expected 1 component, found %u'
2021-10-06T15:54:28Z esxupdate: 2101293: esxupdate: ERROR: ValueError: Expected 1 component, found 2
2021-10-06T15:54:28Z esxupdate: 2101293: esxupdate: DEBUG: <<<

[N1land]

I have the same issue. I looks like these VIBs are failing to install because they are self signed

2021-10-07T10:10:57Z esxupdate: 1061175: vmware.esximage.Vib: DEBUG: Verifying VIB VMware_bootbank_esx-update_7.0.3-0.0.18644231 signature #2
2021-10-07T10:10:57Z esxupdate: 1061175: vmware.esximage.Vib: ERROR: Failed to verify VIB signature #2: ('VMware_bootbank_esx-update_7.0.3-0.0.18644231', 'Could not find a trusted signer: self signed certificate')
2021-10-07T10:10:57Z esxupdate: 1061175: vmware.esximage.Vib: DEBUG: Verifying VIB VMware_bootbank_esx-update_7.0.3-0.0.18644231 signature #1
2021-10-07T10:10:59Z esxupdate: 1061175: vmware.esximage.Vib: DEBUG: Verifying VIB VMware_bootbank_loadesx_7.0.3-0.0.18644231 signature #2
2021-10-07T10:10:59Z esxupdate: 1061175: vmware.esximage.Vib: ERROR: Failed to verify VIB signature #2: ('VMware_bootbank_loadesx_7.0.3-0.0.18644231', 'Could not find a trusted signer: self signed certificate')
2021-10-07T10:10:59Z esxupdate: 1061175: vmware.esximage.Vib: DEBUG: Verifying VIB VMware_bootbank_loadesx_7.0.3-0.0.18644231 signature #1

[porettoa]

Hello,

Are you refering to the host not joing HA or the patch updates? I did not see the cert issue in my log file from the esxi host.  Full logged attached. Also attached are the patch ID's that fail.  Thanks 

[N1land]

I was talking about the patch updates. Can you run this command on your ESXi host and see if can see the same errors I have?

zcat /var/run/log/esxupdate.*.gz|grep ERROR

[porettoa]

I did not see the error you have - I attached the output. Thanks

[porettoa]

FYI - I dowanloed the lastest  VMware-VMvisor-Installer-7.0U3-18644231.x86_64.iso and manually installed using a USB drive. After that I was able to install updates and rejoin HA. 

[N1land]

I tried booting from the ISO and updating but it did not work.

I used the install command instead of update and it did the trick. It removed a few VIBs that must have been causing the issues.

esxcli software profile install -p DEL-ESXi-703_18644231-A00 -d /vmfs/volumes/5f436c72-e018bfc0-a5dd-2cea7f5629a5/VMware-VMvisor-Installer-7.0.0.update03-18644231.x86_64-DellEMC_Customized-A00.zip --ok-to-remove

[mluhn]

Possibly you are seeing something related to this KB https://kb.vmware.com/s/article/2056299

I think try and reinstall fdm agent

1. If the problem persists, review the /var/run/log/fdm-installer.log file:

cat /var/run/log/fdm-installer.log |less

• If you see errors for third-party VIBs such as the below see Resolve third-party VIB preventing vSphere HA agent updates:

bootbank_qlogic_hcli_2.2.60.7.0.0vmw.500.0.0.472560 violates extensibility rule: Installing the VIB

fdm-installer: [24683] 2013-07-18 18:41:45: Result of esxcli software vib install -v=/tmp/vmware-root/ha-agentmgr/vpx-upgrade-installer/vmware-fdm.vib: [DependencyError]

fdm-installer: VIB QLogic_bootbank_qlogic_hcli_2.2.60.7.0.0vmw.500.0.0.472560 violates extensibility rule checks: [u'(line 31: col 0) Element vib failed to validate content']

fdm-installer

[akarydas2]

I had exactly the same and following helped:

https://kb.vmware.com/s/article/85982

worth giving it a try.