Video Screencast Help

SCSP Agent won't start after server reboot

Created: 24 Jul 2012 • Updated: 10 Aug 2012 | 3 comments
This issue has been solved. See solution.

I'm running 5.2.8.264 on the console and the agent.  We have a null policy on IPS (primarily using IDS). 

The agent has been installed on our primary domain controller (Server 2008 R2, physical server).  It's been running fine for months. We rebooted the server and now the IDS agent won't start.  The specific error from the event log is as follows:

"Faulting application name: SISIDSService.exe, version: 5.2.8.264, time stamp: 0x4f6240e0

Faulting module name: RPCRT4.dll, version: 6.1.7601.17514, time stamp: 0x4ce7ba59

Exception code: 0xc0020043

Fault offset: 0x0005cd99

Faulting process id: 0x1d8

Faulting application start time: 0x01cd6955144d962f

Faulting application path: C:\Program Files (x86)\Symantec\Critical System Protection\Agent\IDS\bin\SISIDSService.exe

Faulting module path: C:\Windows\syswow64\RPCRT4.dll"

 

I've uninstalled and reinstalled the agent.  When I do this, the agent runs just fine until we reboot the DC, at which point it fails to start and throws the above error. 

 

Any ideas would be appreciated!

Thanks....

Comments 3 CommentsJump to latest comment

Chuck Edson's picture

If you post the service log, we may have some more insight as to why this is occurring.

Also, if you have another machine with the RPCRT4.dll file that is not having the issue, you may want to do a MD5 hash or SHA128 hash check on both files and see if they are the same.  I suppose it is possible the something is wrong with that .dll file.  Also check the file permissions for the .dll file and compare with a good one.

 

If a post helps you, please mark it as the solution to your issue.

John Q.'s picture

 

As your Agent is installed on a DC, I would recommend you to install newer version of SCSP in order to avoid some known issues:
http://www.symantec.com/docs/TECH188523
 
For your info, latest build currently available on https://fileconnect.symantec.com is 5.2.8 MP4 (http://www.symantec.com/docs/DOC5734).
 

Please remember to mark the proper comment as SOLUTION:
 - to identify threads that do not require further assistance
 - to let other visitors know how to fix such issue

SOLUTION
onebouchard's picture

Thank you for the responses, I appreciate it!

I updated the agents from 5.2.8.186 and 5.2.8.264 to 5.2.8.337 and that seems to have worked.  When I perform the upgrade, the server requests a reboot.  I need to wait for our next maintenance window to do this, so I haven't verified that the problem is resolved on the DCs.

I have a 64 bit Windows 7 physical machine that I successfully replicated the problem on, though. With 5.2.8.186 I saw the same issue...the service wouldn't start after the reboot. Once I upgraded to 5.2.8.337 the service has been very stable, surviving multiple service restarts and reboots.

Thanks again for the help.