Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.

Altiris Agent Blacklist

Created: 18 Jan 2013 • Updated: 18 Jan 2013 | 1 comment

I am getting this error in the Altiris Log Viewer:

Log File Name: C:\ProgramData\Symantec\SMP\Logs\a.log
Priority: 2
Date: 1/18/2013 10:08:40 AM
Tick Count: 284417718
Host Name: UNMCCMS
Process: AeXSvc (1176)
Thread ID: 222
Module: AeXSVC.exe
Source: Altiris.NS.ResourceManagement.MessagingResource.Save_Impl
Description: Attempt to save messaging resource with guid psyt-HICSA-TA (0091b3c0-85cf-46bc-b498-45f810055f67) has been blocked by the Host Resource Blacklist.

There are no computers in the Blacklisted Host Computers Filter.

http://www.symantec.com/business/support/index?page=content&id=TECH122377&profileURL=https%3A%2F%2Fsymaccount-profile.symantec.com%2FSSO%2Findex.jsp%3FssoID%3D1358528417403dOz0P4nWZXEW5b437bACYX4Tn90pdkM8dkUO7
 

In looking up the error I found this article pointing to the issue being related to having multiple NS servers. We only have one NS server, so the cause in this article appears to not be related to our issue.

(http://www.symantec.com/business/support/index?page=content&id=HOWTO9748)

Further research on this issue found this article here:

(http://www.symantec.com/business/support/index?page=content&id=HOWTO26068)

But the results of the query are:

BlacklistDate Resource2Guid Resource2Name ********** Resource1guid Resource1Name _resourceguid name ********** MergeKeyName MergeKeyValue
2013-01-18 08:55:31.477 NULL NULL ********** NULL NULL NULL NULL ********** NULL NULL

Which appears to also be not helpful in finding out why these machines are being blacklisted. The query also revealed that there are thousands of computers on this list going back 4 months. Does anyone have any other suggestions on what I can try to determine why the agents are being blacklisted, and why the built in process refered to in the article above appears to not be working?

Thank you.

Comments 1 CommentJump to latest comment

mclemson's picture

Do you have a script or task telling computers to run AeXAgentUtil.exe /resetguid or a similar command as a result of duplicate GUIDs in your environment?

I've seen this be caused by SQL deadlocks and poor SQL performance.  See here:
https://www-secure.symantec.com/connect/forums/re-...

That same thread also discusses modifying thread pool size.

Have you tried emptying out the Agent Blacklist filter?  If you delete one computer, then force it to update config and it works properly, you may be able to delete all.  In other words, Altiris may have added them there mistakenly during a SQL hiccup.
 

Mike Clemson, Senior Systems Engineer, ASC
Intuitive Technology Group -- Symantec Platinum Partner
intuitivetech.com