Client Management Suite

Over the last month I have noticed that there are several machines that aren't communicating with the server.  When I investigated further, the SMA service was stopped, when restarted it would connect and then stop itself again.  In the Crash History Log the module is AMAgent.dll, which is for the Application Metering agent.  I have 10 applicaiton metering policies enabled which doesn't seem to be causing a problem on majority of the machines.

I have looked through the knowledgebase articles, everything is related to 7.0/7.1 and advises it will be fixed in 7.5, that doesn't appear to be the case. I am running 7.5, new install no upgrade from 7.0/7.1, migrated the machines from 6.x.

Anyone have any ideas on how to get the agents back to a working state?  There are a few hundred machines, other than disabling the application metering agent install/upgrade and performing an uninstall/reinstall of the SMA I'm not sure where to go from here.

Any thoughts would be greatly appreciated.

Regards,

Michelle

Hi Michelle,

It will be really good if you may share crash dump and SMA logs from one-two of the problematic agent. We need to double-check if this issue is known for dev team.

Which OSes are affected, or problem is common for any OS?

SMA service has recovery options. These recovery options configured so, that service won't start if it fails more than three times in one day, to avoid situation then SMA restarts constantly.

You may try to modify recovery options, for example command line below will force SMA service to perform the restart in case of failure:

sc failure AexNSClient reset= 0 actions= restart/5000

This is for your consideration, as in case if failures happened constantly SMA will be constantly restarted. I suggest to try on several clients to see if such approach will work. And it might be better to hold-on with any actions before we do initial log and dump analysis.

Thank you,

Alex.

So far I have seen it occurring on Win 7 64bit machines.  The crash dump log shows the below message, this is the same across all the machines I have looked at so far. I have attached the SMA log as well.

Another thing that may be unrelated. in the C:\program files\Altiris\Altiris Agent\Queue folder there is a listing for both the old 6.x server as well as the new 7.5 server.  There are also some nse files as well, I assume for the Application Metering policies that are set on a weekly schedule for start events. 

----------------------------------------------------------------------------------------
Time: Thursday, August 14, 2014 2:57:27 PM
Process: AeXNSAgentHostSurrogate32.exe
Module: AMAgent.dll
Dump File: C:\ProgramData\Symantec\Symantec Agent\CrashDumps\AeXNSAgentHostSurrogate32_19804_1987C_TOR01015326_2014-08-14_18-57-20.dmp.ez
Process ID: 19804
Thread ID: 1987C
Context Record: 01FBF43C
Exception Record: 01FBF3EC
Exception Code: C00000FD
Flags: 00000000
Address: 0199BD37

EAX=01EC2000 EBX=00000000 ECX=018BA66C EDX=033A0026 ESI=01A3E33C
EDI=019DAA79 EBP=01FBFA08 ESP=01FBF8A0 EIP=0199BD37 FLG=00010206
CS=0023 DS=002B SS=002B ES=002B FS=0053 GS=002B

----------------------------------------------------------------------------------------

Attachment(s)

Agent2_1.txt   100 KB 1 version

Thank you for update on this issue.

If possible, please attach also file AeXNSAgentHostSurrogate32_19804_1987C_TOR01015326_2014-08-14_18-57-20.dmp.ez - it contains most useful information for the problem research.

Alex.

Alex, I have attached the file as requested.

Attachment(s)

AeXNSAgentHostSurrogate32_19A9C_19928_TOR01015326_2014-08...dmp_   17.49 MB 1 version

Thanks again, msigler.

I have passed logs and dump to dev for deeper analysis. As I see, we have fixed several very similar crashes in 7.5 and 7.5.SP1, but it seems like this is slightly different problem in the same dll :(

Alex.

Update: thank you for providing log and dump - root of the problem already found.

Unfortunately, no workaround exists. Please contact support for the pointfix - mainline dev will try to address the issue in the next release, but as I understood this is too long to wait in such situation.

Regards,

Alex.