This issue has been solved.

SCSP Agent won't start after server reboot

Created: 24 Jul 2012 • Updated: 10 Aug 2012
Login to vote
0 0 Votes

I'm running 5.2.8.264 on the console and the agent.  We have a null policy on IPS (primarily using IDS). 

The agent has been installed on our primary domain controller (Server 2008 R2, physical server).  It's been running fine for months. We rebooted the server and now the IDS agent won't start.  The specific error from the event log is as follows:

"Faulting application name: SISIDSService.exe, version: 5.2.8.264, time stamp: 0x4f6240e0

Faulting module name: RPCRT4.dll, version: 6.1.7601.17514, time stamp: 0x4ce7ba59

Exception code: 0xc0020043

Fault offset: 0x0005cd99

Faulting process id: 0x1d8

Faulting application start time: 0x01cd6955144d962f

Faulting application path: C:\Program Files (x86)\Symantec\Critical System Protection\Agent\IDS\bin\SISIDSService.exe

Faulting module path: C:\Windows\syswow64\RPCRT4.dll"

 

I've uninstalled and reinstalled the agent.  When I do this, the agent runs just fine until we reboot the DC, at which point it fails to start and throws the above error. 

 

Any ideas would be appreciated!

Thanks....

Quick Look Solution

  As your Agent is installed

 

As your Agent is installed on a DC, I would recommend you to install newer version of SCSP in order to avoid some known issues:
http://www.symantec.com/docs/TECH188523
 
For your info, latest build currently available on https://fileconnect.symantec.com is 5.2.8 MP4 (http://www.symantec.com/docs/DOC5734).
 

Filed Under

Comments

Chuck Edson's picture
Chuck Edson
Symantec Employee
Accredited
Certified
24
Jul
2012

Can you post the \scsplog\SISIPSService.log file?

If you post the service log, we may have some more insight as to why this is occurring.

Also, if you have another machine with the RPCRT4.dll file that is not having the issue, you may want to do a MD5 hash or SHA128 hash check on both files and see if they are the same.  I suppose it is possible the something is wrong with that .dll file.  Also check the file permissions for the .dll file and compare with a good one.

 

If a post helps you, please mark it as the solution to your issue.

John Q.'s picture
John Q.
Symantec Employee
Accredited
Certified
05
Aug
2012
SOLUTION

  As your Agent is installed

 

As your Agent is installed on a DC, I would recommend you to install newer version of SCSP in order to avoid some known issues:
http://www.symantec.com/docs/TECH188523
 
For your info, latest build currently available on https://fileconnect.symantec.com is 5.2.8 MP4 (http://www.symantec.com/docs/DOC5734).
 

Please remember to mark the proper comment as SOLUTION:
 - to identify threads that do not require further assistance
 - to let other visitors know how to fix such issue

10
Aug
2012

Thank you for the responses,

Thank you for the responses, I appreciate it!

I updated the agents from 5.2.8.186 and 5.2.8.264 to 5.2.8.337 and that seems to have worked.  When I perform the upgrade, the server requests a reboot.  I need to wait for our next maintenance window to do this, so I haven't verified that the problem is resolved on the DCs.

I have a 64 bit Windows 7 physical machine that I successfully replicated the problem on, though. With 5.2.8.186 I saw the same issue...the service wouldn't start after the reboot. Once I upgraded to 5.2.8.337 the service has been very stable, surviving multiple service restarts and reboots.

Thanks again for the help.