Critical System Protection

 View Only
  • 1.  SCSP Agent won't start after server reboot

    Posted Jul 24, 2012 04:35 PM

    I'm running 5.2.8.264 on the console and the agent.  We have a null policy on IPS (primarily using IDS). 

    The agent has been installed on our primary domain controller (Server 2008 R2, physical server).  It's been running fine for months. We rebooted the server and now the IDS agent won't start.  The specific error from the event log is as follows:

    "Faulting application name: SISIDSService.exe, version: 5.2.8.264, time stamp: 0x4f6240e0

    Faulting module name: RPCRT4.dll, version: 6.1.7601.17514, time stamp: 0x4ce7ba59

    Exception code: 0xc0020043

    Fault offset: 0x0005cd99

    Faulting process id: 0x1d8

    Faulting application start time: 0x01cd6955144d962f

    Faulting application path: C:\Program Files (x86)\Symantec\Critical System Protection\Agent\IDS\bin\SISIDSService.exe

    Faulting module path: C:\Windows\syswow64\RPCRT4.dll"

     

    I've uninstalled and reinstalled the agent.  When I do this, the agent runs just fine until we reboot the DC, at which point it fails to start and throws the above error. 

     

    Any ideas would be appreciated!


    Thanks....



  • 2.  RE: SCSP Agent won't start after server reboot

    Posted Jul 24, 2012 06:40 PM

    If you post the service log, we may have some more insight as to why this is occurring.

    Also, if you have another machine with the RPCRT4.dll file that is not having the issue, you may want to do a MD5 hash or SHA128 hash check on both files and see if they are the same.  I suppose it is possible the something is wrong with that .dll file.  Also check the file permissions for the .dll file and compare with a good one.

     



  • 3.  RE: SCSP Agent won't start after server reboot
    Best Answer

    Posted Aug 05, 2012 09:03 AM

     

    As your Agent is installed on a DC, I would recommend you to install newer version of SCSP in order to avoid some known issues:
    http://www.symantec.com/docs/TECH188523
     
    For your info, latest build currently available on https://fileconnect.symantec.com is 5.2.8 MP4 (http://www.symantec.com/docs/DOC5734).
     


  • 4.  RE: SCSP Agent won't start after server reboot

    Posted Aug 10, 2012 09:42 AM

    Thank you for the responses, I appreciate it!

    I updated the agents from 5.2.8.186 and 5.2.8.264 to 5.2.8.337 and that seems to have worked.  When I perform the upgrade, the server requests a reboot.  I need to wait for our next maintenance window to do this, so I haven't verified that the problem is resolved on the DCs.

    I have a 64 bit Windows 7 physical machine that I successfully replicated the problem on, though. With 5.2.8.186 I saw the same issue...the service wouldn't start after the reboot. Once I upgraded to 5.2.8.337 the service has been very stable, surviving multiple service restarts and reboots.

    Thanks again for the help.