@astrugatch Short answer: no, the existing FOG Client does not pull the agent by itself. You push the agent with the tool you already use to deploy software.

What happens when you upgrade the server

Your legacy FOG Client installs keep working against 1.6. The server still serves the legacy client endpoints, so you can run both while you migrate. Nothing on the server needs to change first. Hosts, groups, snapins, printers, power schedules and module settings all carry over. The legacy Client Updater module is gone in 1.6. So the old client cannot update itself into the agent. The FOG server does not host the agent installer. It comes from the GitHub releases page: https://github.com/FOGProject/fog-agent/releases/latest

How to move a machine to the agent

Install the agent MSI on the machine. The MSI finds the legacy “FOG Service” and removes it for you. Do not run the two side by side.

For a silent push (GPO, PDQ, SCCM/Intune, or a script):

msiexec /i fog-agent-<version>-x64.msi /qn SERVER=https://your-fog-server/fog CAFINGERPRINT=<fingerprint> TOKEN=<token> /l*v C:\fog-agent-install.log SERVER is your web UI address with /fog on the end. Old scripts that use WEBADDRESS and WEBROOT still work. CAFINGERPRINT is the SHA-256 on the Root row of FOG Configuration → Certificates. Leave it out if your web UI uses a public or corporate certificate that the machines already trust. TOKEN is optional. Create one under Hosts → Agent Enrollment Tokens. With a token, the host enrolls with no click. Without one, each host waits under Hosts → Pending Agents until you approve it.

The FOG Client page in the 1.6 main menu shows the same command with your server address already filled in.

Images

You can put the agent in your image. Capture the machine as it is, no sysprep needed. A deployed clone detects that it is a different machine and enrolls as itself. If FOG deployed to that host in the last 24 hours, the server approves it automatically.

Docs

Install and migrate: https://docs.fogproject.org/en/latest/installation/client/install-fog-agent (see “Moving from the legacy client”) What changes for an admin (printers, AD join, user tracking): https://docs.fogproject.org/en/latest/management/web/fog-agent Reference: https://docs.fogproject.org/en/latest/kb/reference/fog-agent-reference Troubleshooting: https://docs.fogproject.org/en/latest/kb/troubleshooting/fog-agent-troubleshooting

If an install fails, post C:\ProgramData\FOG\fog-agent.log and the msiexec log here.

@ahaeder A final setting - you have to set Bios exit type = GRUB (not the default SANBOOT) or the boot hangs at ‘Booting from SAN device’.

@Tom-Elliott That was quick 😊 I just tested and it works as expected. Thank you.

Rahman

@azm9s Good that legacy boot works now. For UEFI, your first tcpdump already shows one problem. It stops UEFI clients on every board, with Secure Boot on or off.

First: remove option 60 from your Windows DHCP server.
Your DHCP offer contains option 60 = “PXEClient”. UEFI firmware reads this as “this server is a PXE boot server”. It sends a second request to 192.168.65.35 on UDP port 4011 and waits. FOG does not listen on port 4011, so the firmware stops before it downloads any file. That is why no boot file worked. Legacy network boot does not do this, so legacy works. You only need option 60 if WDS runs on the same server as DHCP.

Second: set option 67 for UEFI to secureboot/snponly-shimx64.efi.
Your version (1.5.10.2253) installs this file. Check that it is there:

ls /tftpboot/secureboot/

It is signed by Microsoft, so it boots with Secure Boot on or off. You do not need to disable Secure Boot. Do not point option 67 at secureboot/ipxe.efi directly. With Secure Boot on, the firmware rejects it. If the menu loads but the network does not start, use secureboot/ipxe-shimx64.efi instead.

To keep legacy and UEFI working at the same time, use Windows DHCP policies. Vendor class PXEClient:Arch:00000 keeps your current legacy file, and PXEClient:Arch:00007 gets the file above:
https://docs.fogproject.org/en/latest/kb/how-tos/bios-and-uefi-co-existence

If UEFI still fails after these two changes, run this on the FOG server while the PC boots, and post the output:

tcpdump -i eth0 -n -vv ether host fc:9d:05:76:7c:00

@Tom-Elliott

I’ve updated my FOG to the stable release and also updated my script with the following three lines, and everything’s fine – the database has been backed up successfully, it’s perfect!

fogApiToken="XYZ=" fogUsrToken="ZYF" curl -ik -X GET "http://$fogServerAddress/fog/system/export" -H "fog-api-token: $fogApiToken" -H "fog-user-token: $fogUsrToken" -o $backupDir/mysql/fog.sql 2>>$backupDir/logs/error.log 1>>$backupDir/logs/progress.log 2>&1

Thanks again for all your hard work on the FOG project!

Managed to figure it out after looking in the wiki for instructions to uninstall FOG with the intention of reinstalling it. Delete that file, delete the fogproject user, and run the install script again. Now it works.

@Bhav There is not at this point in time.

Secure boot is meant to be… well, secure.

There are people attempting to get there, but I can say, right now, FOG just isn’t there right now.

On the forums you can see this at:
https://forums.fogproject.org/topic/17949/fog-secure-boot-with-shim

Which might help lead you in the direction as well hopefully.

@astrugatch we have firewalld but you can make the adjustments… some ports have been changed from the initial setup due to network restrictions.

- name: FOG_Services short: FOG Server network rules description: >- For FOG Server to handle boot, image and various tasks on workstations sources: - SUBNET_IPS allow_icmp: - echo-request - echo-reply services: - ftp - http - mountd - nfs - rpc-bind - tftp ports: - { port: 20048, proto: tcp } # nfs - { port: 20048, proto: udp } # nfs - { port: "35350-36350", proto: udp } # tftp - { port: "49512-65532", proto: udp } # multicast

@Tom-Elliott Do the values in .fogsettings get applied only the first time installfog.sh is executed, or are they supposed to be applied on every subsequent run as well?
In my case, updating .fogsettings after the initial installation doesn’t seem to change anything, so I want to confirm whether this is expected behavior or if I’m missing something.

@Tom-Elliott said in FOG Client service disconnection, pending snapins are not even being detected:

@Jamaal The client lives on the Machine itself. not on the fog server.

Those logs live on teh Windows machine I forget the exact path but something like:

c:\program files\fog client\fog-error.log or something like that?

Yes, it’s c:\program files (x86)\fog\fog.log

I figured out the issue, lol. I was having a moment, but thanks for helping me out.

@george1421
to be adding some to this topic since our system was broken again with the same problems.

I updated recently to newer fog version (1.5.10.1751 and today to 1.5.10.1754) and that seems to break it again.
I noticed that updating also starts using latest Initrd. (2025.02.4)

Things are broken with latest Initrd. I set it back to 2024.02.9 AMD/Intel 64 bit and it is working again.
Then i updated Initrd to 202502.0 AMD/Intel 64 bit and it is still working.

Strange thing is that in webinterface the latest version is shown multiple times.
When I open and download the upper one during pxe boot I see version 20251221 loaded. That one is not working.

Is there anywhere to analyse what the differences are?

I also want to add that we were focussing on nvme. But VROC doesn’t seem to work with nvme in raid.
There are sata ssd/nvme in those slots.

4bcbb845-8bb5-458c-b27a-8794b9b0a5b6-afbeelding.png

@lucasgfaj Thanks for letting us know:

I think I’ve found the issue and pushed a code change to try to fix this.

There is a FOS image experimental release that is building currently (2025-12-21) that should contain this once it’s complete. Please download the inits and install them and run a test to see if this is correcting the issue of capture/deploy Multi Partition Image - All disks and let us know if this new version fixes the issue you’ve reported.

Thank you!

@mmoore5553 Understood and appreciate the return with new information.

i’m not sure what caused it but glad it has since been addressed/fixed.

Thank you! And yes, I gave an upvote!

@Tom-Elliott Hi Tom,

Thank you, that clarifies a lot. I now understand that hostSecTime represents the expiration time, not the creation time, which fully explains the consistent +30 minute offset I was seeing. That part now makes sense and resolves my question.

The only remaining actual issue I’m trying to understand is the snapin behavior: in several cases, snapins did not execute on some hosts. I don’t see any errors in the logs. Only that the snap-in task doesn’t start, but I will work on this and gather some more data. Thank you!

@Tom-Elliott oh, sorry, I didn’t notice this big yellow button in the General tab

48c096ca-5f09-42d1-84dc-647e5bc6e22d-image.png

And I can see the same button for the group, so I guess I can handle this. Thank you very much @Tom-Elliott ! 😄

@Tom-Elliott

Well, the errors I can see in the /var/log/apache2/other_vhosts_access.log are:

172.120.1.253:443 172.120.1.195 - - [09/Oct/2025:18:47:03 +0800] "POST /fog/service/Pre_Stage1.php HTTP/1.1" 500 3891 "-" "curl/8.14.1" 172.120.1.253:443 172.120.1.195 - - [09/Oct/2025:18:47:08 +0800] "POST /fog/service/Pre_Stage1.php HTTP/1.1" 500 3891 "-" "curl/8.14.1" 172.120.1.253:443 172.120.1.195 - - [09/Oct/2025:18:47:13 +0800] "POST /fog/service/Pre_Stage1.php HTTP/1.1" 500 3891 "-" "curl/8.14.1" 172.120.1.253:443 172.120.1.195 - - [09/Oct/2025:18:47:18 +0800] "POST /fog/service/Pre_Stage1.php HTTP/1.1" 500 3891 "-" "curl/8.14.1"

Regarding the /var/log/apache2/error.log are:

[Thu Oct 09 18:48:29.019424 2025] [proxy_fcgi:error] [pid 1662:tid 1662] [client 172.120.1.195:59922] AH01071: Got error 'PHP message: PHP Fatal error: Uncaught ValueError: min(): Argument #1 ($value) must contain at least one element in /var/www/html/fog/lib/fog/image.class.php:396\nStack trace:\n#0 /var/www/html/fog/lib/fog/image.class.php(396): min()\n#1 /var/www/html/fog/lib/reg-task/taskqueue.class.php(112): Image->getStorageGroup()\n#2 /var/www/html/fog/service/Pre_Stage1.php(24): TaskQueue->checkIn()\n#3 {main}\n thrown in /var/www/html/fog/lib/fog/image.class.php on line 396' [Thu Oct 09 18:48:34.062774 2025] [proxy_fcgi:error] [pid 790:tid 790] [client 172.120.1.195:52762] AH01071: Got error 'PHP message: PHP Fatal error: Uncaught ValueError: min(): Argument #1 ($value) must contain at least one element in /var/www/html/fog/lib/fog/image.class.php:396\nStack trace:\n#0 /var/www/html/fog/lib/fog/image.class.php(396): min()\n#1 /var/www/html/fog/lib/reg-task/taskqueue.class.php(112): Image->getStorageGroup()\n#2 /var/www/html/fog/service/Pre_Stage1.php(24): TaskQueue->checkIn()\n#3 {main}\n thrown in /var/www/html/fog/lib/fog/image.class.php on line 396' [Thu Oct 09 18:48:39.106621 2025] [proxy_fcgi:error] [pid 1461:tid 1461] [client 172.120.1.195:52776] AH01071: Got error 'PHP message: PHP Fatal error: Uncaught ValueError: min(): Argument #1 ($value) must contain at least one element in /var/www/html/fog/lib/fog/image.class.php:396\nStack trace:\n#0 /var/www/html/fog/lib/fog/image.class.php(396): min()\n#1 /var/www/html/fog/lib/reg-task/taskqueue.class.php(112): Image->getStorageGroup()\n#2 /var/www/html/fog/service/Pre_Stage1.php(24): TaskQueue->checkIn()\n#3 {main}\n thrown in /var/www/html/fog/lib/fog/image.class.php on line 396'

The php version the server is running is:

# php --version PHP 8.2.29 (cli) (built: Jul 3 2025 16:16:05) (NTS) Copyright (c) The PHP Group Zend Engine v4.2.29, Copyright (c) Zend Technologies with Zend OPcache v8.2.29, Copyright (c), by Zend Technologies

@Tom-Elliott Hi, I finally made it. Here is a screenshot of the error, installing clone Linux, from 512 gb m2 ssd, to 500 gb m2 ssd. And an error is caused with the sections
5576202d-a566-4124-9c8f-378d29cac505-image.png
b64f740c-5e04-48db-b049-5630abcc1e0a-image.png

@Tom-Elliott, disregard this request.

I edited ‘addsubnetgroup.hook.php’ which simplified getting the client IP and adding the host to the respective group. I understand this also removes certain checks that were in place but for my environment it is now working as intended.

Old ‘addSubnetgroupHost’ function:

public function addSubnetgroupHost($arguments) { if (!in_array($this->node, (array)self::$pluginsinstalled)) { return; } $Host = $arguments['Host']; $mac = $Host->get('mac'); if (!isset($mac)) { return; } // Setup for tests $name = $ipn = $Host->get('name'); $ip = $Host->get('ip'); $ipr = self::resolveHostname($name); // Perform all tests. $ip1t = filter_var($ip, FILTER_VALIDATE_IP); $ip2t = filter_var($ipn, FILTER_VALIDATE_IP); $ip3t = filter_var($ipr, FILTER_VALIDATE_IP); // If resolve hostname returns a valid IP, set IP appropriately. // Otherwise, if the name is valid, use it. // Otherwise, return if base $ip is false. if (false !== $ip3t) { $ip = $ipr; } elseif (false !== $ip2t) { $ip = $ipn; } elseif (false === $ip1t) { return; } // Now list our subnet groups. Route::listem('subnetgroup'); $SNGroups = json_decode(Route::getData()); foreach ($SNGroups->subnetgroups as &$SNGroup) { if (in_array($SNGroup->groupID, $Host->get('groups'))) { $Host->removeGroup($SNGroup->groupID)->save(); } $subnetList = str_replace(' ', '', $SNGroup->subnets); $subnets = explode(',', $subnetList); foreach ($subnets as &$subnet) { if ($this->_ipCIDRCheck($ip, $subnet)) { $Host->addGroup($SNGroup->groupID)->save(); unset($subnet); continue 2; } unset($subnet); } unset($SNGroup); } }

New code:

public function addSubnetgroupHost($arguments) { if (!in_array($this->node, (array)self::$pluginsinstalled)) { return; } $Host = $arguments['Host']; $mac = $Host->get('mac'); if (!isset($mac)) { return; } // Use the real source IP from the request $ip = $_SERVER['REMOTE_ADDR']; // Now list our subnet groups. Route::listem('subnetgroup'); $SNGroups = json_decode(Route::getData()); foreach ($SNGroups->subnetgroups as &$SNGroup) { if (in_array($SNGroup->groupID, $Host->get('groups'))) { $Host->removeGroup($SNGroup->groupID)->save(); } $subnetList = str_replace(' ', '', $SNGroup->subnets); $subnets = explode(',', $subnetList); foreach ($subnets as &$subnet) { if ($this->_ipCIDRCheck($ip, $subnet)) { $Host->addGroup($SNGroup->groupID)->save(); unset($subnet); continue 2; } unset($subnet); } unset($SNGroup); } }

@tchavei2

check out my image! Let me know if it works for you

https://forums.fogproject.org/topic/18000/unofficial-docker-image-beta