Content Troubleshooting

This deep dive covers how to troubleshoot content location issues on the client and server-side in Configuration Manager.

Video: Content Troubleshooting Deep Dive (Full Video)

Video: Content Troubleshooting Video Timeline

  • Meet the Patch My PC Team!: (0:00​)

  • Scenario 1 - What happens on a successful content lookup in SCCM: (1:35​)

  • Review valid boundary, boundary group, and content distribution: (2:32​) How to Enable Verbose Logging in ConfigMgr/SCCM Client: (3:40​)

  • Client logs for content location request in SCCM: (4:30​)

  • Review Client Log Files CAS.log CIAgent.log CIDownloader.log CIStateStore.log ClientLocation.log CMBITSManager.log ContentTransferManager.log DataTransferService.log DCMAgent.log LocationServices.log StateMessage.log UpdatesDeployment.log : (4:50​)

  • CCIStateStore::GetCIState - Client is requesting CI ModelName: (6:45​)

  • ===== CacheManager: Content for Content_{guid} was NOT found cache. =====: (7:45​)

  • Client location request in CAS.log ContentLocationRequest: (8:00​)

  • Review MP_Location.log on the management point and the stored procedure MP_GetContentDPInfo: (9:20​)

  • DataTransferService.log creating a bits download request: (11:10​)

  • Review downloaded update in the CCMCache folder: (12:40​)

  • Review the MP_GetContentDPInfo stored procedure in the ConfigMgr database: (14:30​)

  • Scenario 2 - Boundary Groups Misconfigured: (17:25​)

  • Client is not in a boundary group in SCCM: (17:48​)

  • Attempt application install in SCCM when the client isn't in boundary group: (18:45​)

  • Application installed fails with error code 0x87D00607 in SCCM/ConfigMgr: (21:18​)

  • Enable fallback for content in the configuration manager site: (28:12​)

  • Troubleshooting content distribution failures in Configuration Manager (SCCM): (34:45​)

  • Content corruption in SMSContentLib directory: (38:44​)

  • Wrapping up: (48:40​)

Scenario 1: Succesful Content Lookup Workflow

Pre-Conditions

  1. Healthy ConfigMgr client.

  2. The client is in a boundary.

  3. There is a Distribution Point associated with the boundary group.

  4. The content is distributed successfully to the DP.

  5. The software / update / package is deployed to the device.

  6. Enable verbose logging on the site system with the MP role and the client

Successful Content Lookup Flow

There are many moving parts when a content location request is sent to the management point and processes by a ConfigMgr client. Here are some key snippets of how this happens.

Tip: You can open all content logs at once in CMTrace.exe by adding the following files: "CAS.log" "CIAgent.log" "CIDownloader.log" "CIStateStore.log" "ClientLocation.log" "CMBITSManager.log" "ContentTransferManager.log" "DataTransferService.log" "DCMAgent.log" "LocationServices.log" "StateMessage.log" "UpdatesDeployment.log"

Snippets of Location Request

Example of the management point MP_Location.log calling the stored procedure MP_GetContentDPInfo

<ServerNameList>
    <ServerName LocalityEx="256" Fallback="0">DEMO1.CONTOSO.LOCAL</ServerName>
</ServerNameList>,SMSUpdate,00000000,CONTOSO.LOCAL,CONTOSO.LOCAL,<ClientLocationInfo LocationType="SMSUpdate" DistributeOnDemand="0" UseAzure="0" AllowWUMU="0" UseInternetDP="0" AllowHTTP="1" AllowSMB="1" AllowMulticast="1" AllowSuperPeer="1" DPTokenAuth="1">
<ADSite Name="DEFAULT-FIRST-SITE-NAME"/>
<Forest Name="CONTOSO.LOCAL"/>
<Domain Name="CONTOSO.LOCAL"/>
<IPAddresses>
    <IPAddress SubnetAddress="192.168.10.0" Address="192.168.10.35"/>
</IPAddresses>
<Adapters>
    <Adapter Name="Ethernet" IfType="6" PhysicalAddressExists="1" DnsSuffix="" Description="Microsoft Hyper-V Network Adapter"/>
</Adapters>
<BoundaryGroups BoundaryGroupListRetrieveTime="2021-04-28T15:00:21.637" IsOnVPN="0">
    <BoundaryGroup GroupID="16777218" GroupGUID="ad36e248-a857-45e6-ab82-c179bb680b18" GroupFlag="0"/>
</BoundaryGroups>
</ClientLocationInfo>,<BoundaryGroups BoundaryGroupListRetrieveTime="2021-04-28T15:00:21.637" IsOnVPN="0">
<BoundaryGroup GroupID="16777218" GroupGUID="ad36e248-a857-45e6-ab82-c179bb680b18" GroupFlag="0"/>
</BoundaryGroups>)

Tip: The Fallback="0" or Fallback="1" controls if fallback is allowed. To learn more about fallback see this Microsoft Doc.

Example of a content location request from the client sent to the management point in CAS.log

<ContentLocationRequest SchemaVersion="1.00" BGRVersion="1" ExcludeFileList="">
    <Package ID="UID:9c93cbee-aabc-4daf-996a-4580daa09c87" Version="1" DeploymentFlags="9223372036855300962"/>
    <AssignedSite SiteCode="DM1"/>
    <ClientLocationInfo LocationType="SMSUpdate" DistributeOnDemand="0" UseAzure="0" AllowWUMU="0" UseInternetDP="0" AllowHTTP="1" AllowSMB="1" AllowMulticast="1" AllowSuperPeer="1" DPTokenAuth="1">
        <ADSite Name="Default-First-Site-Name"/>
        <Forest Name="CONTOSO.LOCAL"/>
        <Domain Name="CONTOSO.LOCAL"/>
        <IPAddresses>
            <IPAddress SubnetAddress="192.168.10.0" Address="192.168.10.35"/>
        </IPAddresses>
        <Adapters>
            <Adapter Name="Ethernet" IfType="6" PhysicalAddressExists="1" DnsSuffix="" Description="Microsoft Hyper-V Network Adapter"/>
        </Adapters>
        <BoundaryGroups BoundaryGroupListRetrieveTime="2021-04-28T15:00:21.637" IsOnVPN="0">
            <BoundaryGroup GroupID="16777218" GroupGUID="ad36e248-a857-45e6-ab82-c179bb680b18" GroupFlag="0"/>
        </BoundaryGroups>
    </ClientLocationInfo>
</ContentLocationRequest>

Example of Content location reply from the management point to the client in the client's CAS.log

<ContentLocationReply SchemaVersion="1.00" BGRVersion="1">
    <BoundaryGroups BoundaryGroupListRetrieveTime="2021-04-27T14:21:06.263" IsOnVPN="0">
        <BoundaryGroup GroupID="16777218" GroupGUID="ad36e248-a857-45e6-ab82-c179bb680b18" GroupFlag="0"/>
    </BoundaryGroups>
    <ContentInfo PackageFlags="0" DeploymentFlags="9223372036855300962">
        <ContentHashValues/>
    </ContentInfo>
    <Sites>
        <Site>
            <MPSite SiteCode="DM1" MasterSiteCode="DM1" SiteLocality="LOCAL" IISPreferedPort="80" IISSSLPreferedPort="443"/>
            <LocationRecords>
                <LocationRecord LocalityEx="BOUNDARYGROUP" DPFallbackIn="PT0M">
                    <URL Name="http://DEMO1.CONTOSO.LOCAL/SMS_DP_SMSPKG$/9c93cbee-aabc-4daf-996a-4580daa09c87" Signature="http://DEMO1.CONTOSO.LOCAL/SMS_DP_SMSSIG$/9c93cbee-aabc-4daf-996a-4580daa09c87.1.tar" Capability="0"/>
                    <ADSite Name="Default-First-Site-Name"/>
                    <IPSubnets>
                        <IPSubnet Address="192.168.10.0"/>
                        <IPSubnet Address=""/>
                    </IPSubnets>
                    <Metric Value=""/>
                    <Version>9040</Version>
                    <Capabilities SchemaVersion="1.0">
                        <Property Name="SSLState" Value="0"/>
                    </Capabilities>
                    <ServerRemoteName>DEMO1.CONTOSO.LOCAL</ServerRemoteName>
                    <DPType>SERVER</DPType>
                    <Windows Trust="1"/>
                </LocationRecord>
            </LocationRecords>
        </Site>
    </Sites>
    <RelatedContentIDs/>
</ContentLocationReply>

Here's a snippet of the download options for a software update download request in UpdatesDeploymentAgent.log

<DownloadOptions>
    <Priority>Foreground</Priority>
    <DPLocality>10</DPLocality>
    <Timeout>
        <Location>604800</Location>
        <Download>86400</Download>
        <PerDPInactivity>0</PerDPInactivity>
        <TotalInactivity>0</TotalInactivity>
        <UseBranchCache>true</UseBranchCache>
        <PersistOnWriteFilterDevices>false</PersistOnWriteFilterDevices>
        <OverrideServiceWindows>false</OverrideServiceWindows>
    </Timeout>
</DownloadOptions>

A point of interest is DPLocality flag determines how the client obtains distribution points, according to distribution point locality. Possible values are:

Scenario 2: Failed Content Lookup Due to Boundary Misconfiguration

Pre-Conditions

  1. Healthy ConfigMgr client.

  2. The client is NOT in a boundary.

  3. There is a Distribution Point associated with the boundary group the client is NOT in.

  4. The content is distributed successfully to the DP.

  5. The software / update / package is deployed to the device.

  6. Enable verbose logging on the site system with the MP role and the client

Notable Ways to Identity when a Client is Not in Boundary Group

If a client is not in a boundary group here are some snippets that can be helpful.

In the content location request in the CAS.log, you will also notice the BoundaryGroup element doesn't contain the fields GroupID, GroupGUID, or GroupFlag.

Tip: Search the text "ContentLocationRequest" in the CAS.log to find location requests performed on the client-side logs.

In the CAS.log here is an example of a response from the management point when the client is in no boundary group, and fallback is disabled, and no content was found.

<ContentLocationReply SchemaVersion="1.00" BGRVersion="1" ContentFlags="86016" HashAlgorithm="32780" AlgorithmPreference="4" Hash="5230AF02CF06BDD36CDD10FD13C4DF795F465E46FC47E1B1A00E44E2589AA6AD" ExcludeFileListHash="" RelatedContentID="">
    <BoundaryGroups BoundaryGroupListRetrieveTime="2021-04-28T15:36:56.910"/>
    <ContentInfo/>
    <Sites>
        <Site>
            <MPSite SiteCode="DM2" MasterSiteCode="DM2" SiteLocality="FALLBACK"/>
            <LocationRecords/>
        </Site>
    </Sites>
    <RelatedContentIDs/>
</ContentLocationReply>

We can compare this to the response received in the CAS.log when the content was found and the client is in a boundary group.

<ContentLocationReply SchemaVersion="1.00" BGRVersion="1">
    <BoundaryGroups BoundaryGroupListRetrieveTime="2021-04-28T15:00:21.637" IsOnVPN="0">
        <BoundaryGroup GroupID="16777218" GroupGUID="ad36e248-a857-45e6-ab82-c179bb680b18" GroupFlag="0"/>
    </BoundaryGroups>
    <ContentInfo PackageFlags="0" DeploymentFlags="9223372036855300962">
        <ContentHashValues/>
    </ContentInfo>
    <Sites>
        <Site>
            <MPSite SiteCode="DM1" MasterSiteCode="DM1" SiteLocality="LOCAL" IISPreferedPort="80" IISSSLPreferedPort="443"/>
            <LocationRecords>
                <LocationRecord LocalityEx="BOUNDARYGROUP" DPFallbackIn="PT0M">
                    <URL Name="http://DEMO1.CONTOSO.LOCAL/SMS_DP_SMSPKG$/9c93cbee-aabc-4daf-996a-4580daa09c87" Signature="http://DEMO1.CONTOSO.LOCAL/SMS_DP_SMSSIG$/9c93cbee-aabc-4daf-996a-4580daa09c87.1.tar" Capability="0"/>
                    <ADSite Name="Default-First-Site-Name"/>
                    <IPSubnets>
                        <IPSubnet Address="192.168.10.0"/>
                        <IPSubnet Address=""/>
                    </IPSubnets>
                    <Metric Value=""/>
                    <Version>9040</Version>
                    <Capabilities SchemaVersion="1.0">
                        <Property Name="SSLState" Value="0"/>
                    </Capabilities>
                    <ServerRemoteName>DEMO1.CONTOSO.LOCAL</ServerRemoteName>
                    <DPType>SERVER</DPType>
                    <Windows Trust="1"/>
                </LocationRecord>
            </LocationRecords>
        </Site>
    </Sites>
    <RelatedContentIDs/>
</ContentLocationReply>

If the content is not found, you will be able to note the following line in StateMessage.log

State message(State ID : 5003) with TopicType 1702 and TopicId ScopeId_CA3F999B-7A81-43BF-912C-56E267C1E565/DeploymentType_677dac51-d2a2-4bbd-aeb0-4b845aa288cd/1 has been recorded for S-1-5-21-1880864260-2612682489-34998949-6112

Scenario 3: Download Failure Due to Content Distribution Failure

This scenario covers some of the basics in troubleshooting content that has failed to distribute to a distribution point.

Log Files for Troubleshooting Content Distribution in ConfigMgr

Example of Error if the Source Folder Doesn't Exist or the Site Server Doesn't Have Access

Scenario 4: Download Failure Due to Invalid Content

For scenario 4, we delete a file directly from the FileLib and modify a file directly in the FileLib. We will cover the content library in a future video. This builds off of scenario 3 by showing specific failure scenarios.

The fix for this type of scenario may be as simple as performing an 'update content' or 'redistribute' the content which is failing. Other times you may have to validate antivirus exclusions on your endpoints and servers. Using the log files to identify what type of error is occurring will be key to resolving the issue and determine where the issue lies.

Example of Error if the Hash of the Downloaded File Does Not Match the Expected Hash

The above log files and lines would be helpful from the client when determining if there is a hash mismatch issue. It is good to note that the hash mismatch may not be due to a corrupt file in the Content Library, but it is still worth investigating. This can also commonly be due to Antivirus on the endpoint which lacks the prover exclusions for example.

Example of Error if a File is Missing from the Content Library When a Client Requests It

Log Files for Troubleshooting

Client Logs

Server Logs

Last updated