Symantec Management Platform (Notification Server)

Hi 

I have alot of computers with Symantec Management Agent crashing. If I start the service it will stop after 30 seconds. In the event log the following is displayed:

Faulting application name: AeXNSAgentHostSurrogate32.exe, version: 7.5.1675.2, time stamp: 0x5331bc0a

Faulting module name: OLEAUT32.dll, version: 6.3.9600.16506, time stamp: 0x52cc911e

Exception code: 0xc0000005

Fault offset: 0x0000e171

Faulting process id: 0x192c

Faulting application start time: 0x01d055c76221a029

Faulting application path: C:\Program Files\Altiris\Altiris Agent\x86\AeXNSAgentHostSurrogate32.exe

Faulting module path: C:\windows\SYSTEM32\OLEAUT32.dll

Report Id: a643288f-c1ba-11e4-8274-0050b67088dc

Faulting package full name:

Faulting package-relative application ID: 

Please help

Hello,

please check https://www-secure.symantec.com/connect/forums/altiris-agent-crasing-because-module-oleaut32dll

Hi

We are on 7.5 and we don't have Out of band plugin? And also the themes startup type is not weird either?

I looked in C:\programdata\Symantec\Symantec Agent\CrashDumps and there are no files either. 

Please help on how to continue.

Hi baatch,

To research the issue logs and dump file for the problematic agent will be really helpful.

Logs might be found in C:\ProgramData\Symantec\Symantec Agent\Logs.

Regarding dumps: please take a look at agent faults report in console: 

Reports - Notification Server Management  - Agent  - Faults - Management service faults 

You should see graph with info about crashes by service\date. If you press to some bar in report then you will be redirected to more detailed report with computer names and dump location.

If it would be possible to find the crash for "AeXNSAgentHostSurrogate32.exe" in this reports and attach dump and logs from one client to this post it will speed-up the investigations.

If you won't be able to find dump using the report, then please try to find dump on a computer itself:  take a look at event log, sometimes it has links to the dump location in temp folder. On Win8 it will be C:\ProgramData\Microsoft\Windows\WER - check ReportArchive and ReportQueue folders.

Thank you,

Alex.

Hi 

When I check the reports they don't show any of the computers having agent crash.

I have found some crashdumps at C:\ProgramData\Microsoft\Windows\WER\ReportQueue and will attach it here.

Attachment(s)

AppCrash_AeXNSAgentHostSu_7cb3b4d18a50f369df6189156c7be6d...zip   2 KB 1 version

Baatch,

If it not too late: is there some other folders in ReportQueue folder? There should be some folders containing MDMP and HDMP files and contain AeXNSAgent in the name. Please attach one of them here if you can find one...

It looks like the crash can be caused by either Inventory or Patch Management solution plugins.

You agent has been upgraded from some 7.1 version, but the patch and inventory plugins are still not upgraded.

They are located here:

C:\Program Files (x86)\Altiris\Altiris Agent\Agents\Inventory Agent
C:\Program Files (x86)\Altiris\Altiris Agent\Agents\PatchMgmtAgent

You may want to check if they should have been upgraded already and trigger upgrade if needed or maybe remove them if you don't need them, they are very old and can cause crashes like this one.

Hi Sergei,

Thanks for replying, I have attached a dump that has an HDMP file.

I don't really get what you mean regarding the agent upgrade of Inventory and Patch.

Some computers have both of these folders:

C:\Program Files (x86)\Altiris\Altiris Agent\Agents\Inventory Agent
C:\Program Files (x86)\Altiris\Altiris Agent\Agents\PatchMgmtAgent

and som have only:

C:\Program Files (x86)\Altiris\Altiris Agent\Agents\Inventory Agent

Some computer agents crash right after imaging is finished. Is it possible we have old agent in the image that gets upgraded after deployment?

How can I remove these plugins if their is a problem with those?

Attachment(s)

AppCrash_AeXNSAgentHostSu_7cb3b4d18a50f369df6189156c7be6d...zip   81 KB 1 version

I have the same problem.

Error messages in the System Logs

The AeXAgentSrvHost service terminated unexpectedly.  It has done this 10 time(s).

The Symantec Management Agent service terminated unexpectedly.  It has done this 10 time(s).  The following corrective action will be taken in 0 milliseconds: Run the configured recovery program.

Attached is a crash dump and the Crash history log.

Attachment(s)

AeXCrashHistory.txt   7 KB 1 version

AeXNSAgentHostSurrogate32_2236_5904_SEC20253_2015-09-01_0...dmp_   21.14 MB 1 version