Client Management Suite

Hi,

Some machines are facing bluescreen error.

When it was debugged they found the reason is our 'Altiris Agent'.

Could you suggest me is that possible ?

If yes , then how to solve this issue?

First -I've never seen the Altiris Agent blue screen a machine. I've seen something the agent delivers to the computer blue screen it, but never the agent itself.

So, do you know how they debugged this issue and reached this conclusion?

Off the top of my head, the only scenario I've ever seen like this which is entirely within scope of the agent and plugins is an issue 3-4 years ago with Carbon Copy. An  incompatibility with an old Intel graphics driver resulted in blue screen (carbon copy has to install a driver).

A boot into safe mode and an upgrade of the intel graphics resolved it back then.

I've never seen a blue screen from the Altiris Agent.

Get the time of the blue screen and look at the agent logs to see what it was doing at the time.

I have found a known issue

http://www.symantec.com/business/support/index?page=content&id=TECH9227

But , I am not sure whether this is the actual problem or is this something else.

@ianatkin May be you are speaking about this issue.

@andykn Thanks for the reply

Hi Abhishek -yep looks like the problem. Time flies huh? That was back in 2007 -ah the good old days.

We found that it only happened on a very few of some older machines in our estate (<1%). A re-image with a later image (with more current drivers) resolved, or if the user had lots of local data and safe-mode boot to get in to resolve did the trick.

Good Luck.

Kind Regards,
Ian./ 

I’ve copied the debugger analysis from Machine. It points to the module atrsdfw.sys (an Altiris component) as the cause of the bugcheck.

Suggest how to proceed ?

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP:

atrsdfw+5192

b9cc1192 2b4e0c          sub     ecx,dword ptr [esi+0Ch]

TRAP_FRAME:  cf70da08 -- (.trap 0xffffffffcf70da08)

ErrCode = 00000000

eax=b9cbf058 ebx=cf70da98 ecx=87ebb960 edx=00000000 esi=00000000 edi=b9cbf020

eip=b9cc1192 esp=cf70da7c ebp=cf70da88 iopl=0         nv up ei pl nz ac po cy

cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010213

atrsdfw+0x5192:

b9cc1192 2b4e0c          sub     ecx,dword ptr [esi+0Ch] ds:0023:0000000c=????????

Resetting default scope

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0x8E

PROCESS_NAME:  iexplore.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from 82efa06c to 82f23ef4

STACK_TEXT: 

cf70d574 82efa06c 0000008e c0000005 b9cc1192 nt!KeBugCheckEx+0x1e

cf70d998 82e83e06 cf70d9b4 00000000 cf70da08 nt!KiDispatchException+0x1ac

cf70da00 82e83dba cf70da88 b9cc1192 badb0d00 nt!CommonDispatchException+0x4a

cf70da1c 82e13ba9 00000000 b9cbf000 cf70da6c nt!Kei386EoiHelper+0x192

cf70da88 b9cc1585 87ebb960 cf70da98 00000000 hal!KfLowerIrql+0x61

WARNING: Stack unwind information not available. Following frames may be wrong.

cf70da9c 8bd85aeb 8a4318f0 cf70dabc cf70dae8 atrsdfw+0x5585

cf70db08 8bd8817b cf70db44 87ebb960 cf70dba4 fltmgr!FltpPerformPreCallbacks+0x34d

cf70db20 8bd9adcf 0070db44 87ebb960 8bd9ac6c fltmgr!FltpPassThroughFastIo+0x3d

cf70db64 830b532e 87ebb960 cf70dbac 00000ea8 fltmgr!FltpFastIoWrite+0x163

cf70dc08 82e8321a 87ba9268 00000000 00000000 nt!NtWriteFile+0x342

cf70dc08 77047094 87ba9268 00000000 00000000 nt!KiFastCallEntry+0x12a

1978f71c 00000000 00000000 00000000 00000000 0x77047094

STACK_COMMAND:  kb

FOLLOWUP_IP:

atrsdfw+5192

b9cc1192 2b4e0c          sub     ecx,dword ptr [esi+0Ch]

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  atrsdfw+5192

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: atrsdfw

IMAGE_NAME:  atrsdfw.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  45b13918

FAILURE_BUCKET_ID:  0x8E_atrsdfw+5192

BUCKET_ID:  0x8E_atrsdfw+5192

Followup: MachineOwner

---------

I think it's time get some environment data before we can help further,

1. What version of Altiris are you running
2. What solutions are you deploying
3. What machines are showing this problem (number, OS version, solutions deployed)
4. What machines are not showing this problem (number OS version, solutions deployed)

Kind Regards,
Ian./

@ianatkin

Thanks for the reply

We are using NS 6.0.6074( SP3  + R13)

These machines are laptops with Win7 Enterprise 6.1 ( 2machines .. details of other 2 machines is not with us)

We are ussing Asset Management, Patch Management, Carbon  Copy etc.

Hi Abishek,

I understand you want to reply quickly, but I really need you to be patient and a bit more thorough.

1. At the moment, it sounds like you have a total of 4 Windows7 computers which are being managed by Altiris, and an unknown number of these have issues.
    
2. The "etc" in your solutions list.. . this really does need expanding.

Sorry to be picky, but we need to get a feel for the scope of the problem if we are to assist.

Drop me a PM if you have difficulties. 5 minutes on Skype with me reporting back here might save us all a lot of time?

Kind Regards,
Ian./

Just had a look at the Altigos forums, and a posts there (by Andy in fact!) indicate that atrsdfw.sys is associated with Altiris Recovery Solution.

It's worth noting that Windows 7 is only supported since 6.2SP4 -so it's worth checking the version you have this installed.

@ianatkin

Thanks for reply,

But Actually , the problem is at client end and I am sitting at remote end.

So I don't have full information by this time.

Altough I have been informed about the case, So I just wanted to know what might be the reason if its not the problem with video driver.

Looking at the Bugcheck I can see "DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT", so I think you may have the solution Ian.

Did you manage to check the version of Recovery Solution being used on this site?