Vague "Patching Failed" alerts FortiClient

Hi SteveJW,

Thanks for using Fortinet Community forums. We’ll look to get you an answer or help. 

Have a nice day,

Hello,

We are still looking for an answer to your question.

We will come back to you ASAP.

Hi again SteveJW,

I talked with one of our engineers, and it doesn’t seem like this is something to be concerned about. Essentially, these ‘Patching failed’ messages are confirmations that auto-updating is not going through.

I’ll quote the person I spoke to:

Vulnerability scanning works by triggering the application to go home, retrieve an update, install, reboot if necessary.

If the application does not have this capability, auto-remediation fails, fc then displays the option to patch manually.

It is possible that 'Patching Failed' simply means that the app was unable to auto-update itself.

 

fc has no input on how the application updates, it can only trigger the application to auto-update. 

 

for windows os patching, the behaviour is different.

fc checks the vulnerability db for Microsoft's kbs and their level of vulnerability. if there are any at the level the ems admin wants the OS to be patched at, ie. critical, fc triggers a windows update to only retrieve the missing kb from the OS, then windows update takes over to install.  if a reboot is required by windows, fc relays this to the user.  on occasion the update fails to install causing fc rescan, request the update, fail the update, then repeat. 

fix for this repeat loop is for the admin to remove the offending kb.

Hope that helps!

Hi Steve,

Are they OS vulnerabilities or application vulnerabilities?

It is not the OS vulnerability scan, as that is disabled.
So, the assumption is that it is the application vulnerability scan.