Video Screencast Help
Give us your opinion and win with Symantec! Please help us by taking this survey to tell us about your experience with Symantec Connect, so that we can continue to grow and improve.  Take the survey.

Vista Collector issue on 2008 R2 Domain Controller

Created: 13 Sep 2012 • Updated: 17 Sep 2012 | 6 comments
This issue has been solved. See solution.

Our vista collector stops after working for a while after installation. We have another DC with same collector configuration and it is working perfectly.

Here is the config of our 2008 R2 DC:

FIPS disabled.

Firewall disabled.

Certificate has imported succesfully with keytool.

WinRM

Config
    MaxEnvelopeSizekb = 150
    MaxTimeoutms = 60000
    MaxBatchItems = 32000
    MaxProviderRequests = 4294967295
    Client
        NetworkDelayms = 5000
        URLPrefix = wsman
        AllowUnencrypted = false
        Auth
            Basic = true
            Digest = true
            Kerberos = true
            Negotiate = true
            Certificate = true
            CredSSP = false
        DefaultPorts
            HTTP = 5985
            HTTPS = 5986
        TrustedHosts
    Service
        RootSDDL = O:NSG:BAD:P(A;;GA;;;BA)S:P(AU;FA;GA;;;WD)(AU;SA;GWGX;;;WD)
        MaxConcurrentOperations = 4294967295
        MaxConcurrentOperationsPerUser = 15
        EnumerationTimeoutms = 60000
        MaxConnections = 25
        MaxPacketRetrievalTimeSeconds = 120
        AllowUnencrypted = true
        Auth
            Basic = false
            Kerberos = true
            Negotiate = true
            Certificate = false
            CredSSP = false
            CbtHardeningLevel = Relaxed
        DefaultPorts
            HTTP = 5985
            HTTPS = 5986
        IPv4Filter = *
        IPv6Filter = *
        EnableCompatibilityHttpListener = false
        EnableCompatibilityHttpsListener = false
        CertificateThumbprint = 3b a1 08 1c 4a b7 ad 70  47 35 a8 50 e3 b7 46 e1dd 86 57 fd
    Winrs
        AllowRemoteShellAccess = true
        IdleTimeout = 180000
        MaxConcurrentUsers = 5
        MaxShellRunTime = 2147483647
        MaxProcessesPerShell = 15
        MaxMemoryPerShellMB = 150
        MaxShellsPerUser = 5

Logs are constanly produced;

Restarting the sensor...
WARN 2012-09-13 16:31:08,966 Collectors.3301.wGroup.[workinggroup0].SensorThread Thread-17 [Sensor: OURDC2] Exception in Sensor thread while reading device. Details:
com.sun.xml.internal.messaging.saaj.SOAPExceptionImpl: Unable to create envelope from given source:
 at com.sun.xml.internal.messaging.saaj.soap.EnvelopeFactory.createEnvelope(EnvelopeFactory.java:114)
 at com.sun.xml.internal.messaging.saaj.soap.ver1_2.SOAPPart1_2Impl.createEnvelopeFromSource(SOAPPart1_2Impl.java:71)
 at com.sun.xml.internal.messaging.saaj.soap.SOAPPartImpl.getEnvelope(SOAPPartImpl.java:122)
 at com.sun.xml.internal.messaging.saaj.soap.MessageImpl.getSOAPHeader(MessageImpl.java:1261)
 at com.symantec.cas.ucf.sensors.ws_management.actions.AbstractSoapAction.init(AbstractSoapAction.java:133)
 at com.symantec.cas.ucf.sensors.ws_management.actions.AbstractSoapAction.<init>(AbstractSoapAction.java:127)
 at com.symantec.cas.ucf.sensors.ws_management.actions.PullAction$Response.<init>(PullAction.java:100)
 at com.symantec.cas.ucf.sensors.ws_management.actions.PullAction.setResponse(PullAction.java:52)
 at com.symantec.cas.ucf.sensors.ws_management.RequestBroker.readResponse(RequestBroker.java:329)
 at com.symantec.cas.ucf.sensors.ws_management.RequestBroker.sendRequest(RequestBroker.java:295)
 at com.symantec.cas.ucf.sensors.ws_management.WSManagementSensor.pullEvents(WSManagementSensor.java:468)
 at com.symantec.cas.ucf.sensors.ws_management.WSManagementSensor.readDevice(WSManagementSensor.java:384)
 at com.symantec.cas.ucf.collector.SensorJob.pollSensor(SensorJob.java:212)
 at com.symantec.cas.ucf.collector.SensorJob.run(SensorJob.java:292)
 at java.lang.Thread.run(Thread.java:662)
Caused by: javax.xml.transform.TransformerException: com.sun.org.apache.xerces.internal.impl.io.MalformedByteSequenceException: Invalid byte 3 of 3-byte UTF-8 sequence.
 at org.apache.xalan.transformer.TransformerIdentityImpl.transform(TransformerIdentityImpl.java:473)
 at com.sun.xml.internal.messaging.saaj.util.transform.EfficientStreamingTransformer.transform(EfficientStreamingTransformer.java:393)
 at com.sun.xml.internal.messaging.saaj.soap.EnvelopeFactory.createEnvelope(EnvelopeFactory.java:102)
 ... 14 more
Caused by: com.sun.org.apache.xerces.internal.impl.io.MalformedByteSequenceException: Invalid byte 3 of 3-byte UTF-8 sequence.
 at com.sun.org.apache.xerces.internal.impl.io.UTF8Reader.invalidByte(UTF8Reader.java:684)
 at com.sun.org.apache.xerces.internal.impl.io.UTF8Reader.read(UTF8Reader.java:432)
 at com.sun.org.apache.xerces.internal.impl.XMLEntityScanner.load(XMLEntityScanner.java:1742)
 at com.sun.org.apache.xerces.internal.impl.XMLEntityScanner.skipChar(XMLEntityScanner.java:1416)
 at com.sun.org.apache.xerces.internal.impl.XMLDocumentFragmentScannerImpl$FragmentContentDriver.next(XMLDocumentFragmentScannerImpl.java:2792)
 at com.sun.org.apache.xerces.internal.impl.XMLDocumentScannerImpl.next(XMLDocumentScannerImpl.java:648)
 at com.sun.org.apache.xerces.internal.impl.XMLNSDocumentScannerImpl.next(XMLNSDocumentScannerImpl.java:140)
 at com.sun.org.apache.xerces.internal.impl.XMLDocumentFragmentScannerImpl.scanDocument(XMLDocumentFragmentScannerImpl.java:511)
 at com.sun.org.apache.xerces.internal.parsers.XML11Configuration.parse(XML11Configuration.java:808)
 at com.sun.org.apache.xerces.internal.parsers.XML11Configuration.parse(XML11Configuration.java:737)
 at com.sun.org.apache.xerces.internal.parsers.XMLParser.parse(XMLParser.java:119)
 at com.sun.org.apache.xerces.internal.parsers.AbstractSAXParser.parse(AbstractSAXParser.java:1205)
 at com.sun.org.apache.xerces.internal.jaxp.SAXParserImpl$JAXPSAXParser.parse(SAXParserImpl.java:522)
 at org.xml.sax.helpers.XMLFilterImpl.parse(XMLFilterImpl.java:333)
 at org.apache.xalan.transformer.TransformerIdentityImpl.transform(TransformerIdentityImpl.java:452)
 ... 16 more

CAUSE:

javax.xml.transform.TransformerException: com.sun.org.apache.xerces.internal.impl.io.MalformedByteSequenceException: Invalid byte 3 of 3-byte UTF-8 sequence.
 at org.apache.xalan.transformer.TransformerIdentityImpl.transform(TransformerIdentityImpl.java:473)
 at com.sun.xml.internal.messaging.saaj.util.transform.EfficientStreamingTransformer.transform(EfficientStreamingTransformer.java:393)
 at com.sun.xml.internal.messaging.saaj.soap.EnvelopeFactory.createEnvelope(EnvelopeFactory.java:102)
 at com.sun.xml.internal.messaging.saaj.soap.ver1_2.SOAPPart1_2Impl.createEnvelopeFromSource(SOAPPart1_2Impl.java:71)
 at com.sun.xml.internal.messaging.saaj.soap.SOAPPartImpl.getEnvelope(SOAPPartImpl.java:122)
 at com.sun.xml.internal.messaging.saaj.soap.MessageImpl.getSOAPHeader(MessageImpl.java:1261)
 at com.symantec.cas.ucf.sensors.ws_management.actions.AbstractSoapAction.init(AbstractSoapAction.java:133)
 at com.symantec.cas.ucf.sensors.ws_management.actions.AbstractSoapAction.<init>(AbstractSoapAction.java:127)
 at com.symantec.cas.ucf.sensors.ws_management.actions.PullAction$Response.<init>(PullAction.java:100)
 at com.symantec.cas.ucf.sensors.ws_management.actions.PullAction.setResponse(PullAction.java:52)
 at com.symantec.cas.ucf.sensors.ws_management.RequestBroker.readResponse(RequestBroker.java:329)
 at com.symantec.cas.ucf.sensors.ws_management.RequestBroker.sendRequest(RequestBroker.java:295)
 at com.symantec.cas.ucf.sensors.ws_management.WSManagementSensor.pullEvents(WSManagementSensor.java:468)
 at com.symantec.cas.ucf.sensors.ws_management.WSManagementSensor.readDevice(WSManagementSensor.java:384)
 at com.symantec.cas.ucf.collector.SensorJob.pollSensor(SensorJob.java:212)
 at com.symantec.cas.ucf.collector.SensorJob.run(SensorJob.java:292)
 at java.lang.Thread.run(Thread.java:662)
Caused by: com.sun.org.apache.xerces.internal.impl.io.MalformedByteSequenceException: Invalid byte 3 of 3-byte UTF-8 sequence.
 at com.sun.org.apache.xerces.internal.impl.io.UTF8Reader.invalidByte(UTF8Reader.java:684)
 at com.sun.org.apache.xerces.internal.impl.io.UTF8Reader.read(UTF8Reader.java:432)
 at com.sun.org.apache.xerces.internal.impl.XMLEntityScanner.load(XMLEntityScanner.java:1742)
 at com.sun.org.apache.xerces.internal.impl.XMLEntityScanner.skipChar(XMLEntityScanner.java:1416)
 at com.sun.org.apache.xerces.internal.impl.XMLDocumentFragmentScannerImpl$FragmentContentDriver.next(XMLDocumentFragmentScannerImpl.java:2792)
 at com.sun.org.apache.xerces.internal.impl.XMLDocumentScannerImpl.next(XMLDocumentScannerImpl.java:648)
 at com.sun.org.apache.xerces.internal.impl.XMLNSDocumentScannerImpl.next(XMLNSDocumentScannerImpl.java:140)
 at com.sun.org.apache.xerces.internal.impl.XMLDocumentFragmentScannerImpl.scanDocument(XMLDocumentFragmentScannerImpl.java:511)
 at com.sun.org.apache.xerces.internal.parsers.XML11Configuration.parse(XML11Configuration.java:808)
 at com.sun.org.apache.xerces.internal.parsers.XML11Configuration.parse(XML11Configuration.java:737)
 at com.sun.org.apache.xerces.internal.parsers.XMLParser.parse(XMLParser.java:119)
 at com.sun.org.apache.xerces.internal.parsers.AbstractSAXParser.parse(AbstractSAXParser.java:1205)
 at com.sun.org.apache.xerces.internal.jaxp.SAXParserImpl$JAXPSAXParser.parse(SAXParserImpl.java:522)
 at org.xml.sax.helpers.XMLFilterImpl.parse(XMLFilterImpl.java:333)
 at org.apache.xalan.transformer.TransformerIdentityImpl.transform(TransformerIdentityImpl.java:452)
 ... 16 more
---------
com.sun.org.apache.xerces.internal.impl.io.MalformedByteSequenceException: Invalid byte 3 of 3-byte UTF-8 sequence.
 at com.sun.org.apache.xerces.internal.impl.io.UTF8Reader.invalidByte(UTF8Reader.java:684)
 at com.sun.org.apache.xerces.internal.impl.io.UTF8Reader.read(UTF8Reader.java:432)
 at com.sun.org.apache.xerces.internal.impl.XMLEntityScanner.load(XMLEntityScanner.java:1742)
 at com.sun.org.apache.xerces.internal.impl.XMLEntityScanner.skipChar(XMLEntityScanner.java:1416)
 at com.sun.org.apache.xerces.internal.impl.XMLDocumentFragmentScannerImpl$FragmentContentDriver.next(XMLDocumentFragmentScannerImpl.java:2792)
 at com.sun.org.apache.xerces.internal.impl.XMLDocumentScannerImpl.next(XMLDocumentScannerImpl.java:648)
 at com.sun.org.apache.xerces.internal.impl.XMLNSDocumentScannerImpl.next(XMLNSDocumentScannerImpl.java:140)
 at com.sun.org.apache.xerces.internal.impl.XMLDocumentFragmentScannerImpl.scanDocument(XMLDocumentFragmentScannerImpl.java:511)
 at com.sun.org.apache.xerces.internal.parsers.XML11Configuration.parse(XML11Configuration.java:808)
 at com.sun.org.apache.xerces.internal.parsers.XML11Configuration.parse(XML11Configuration.java:737)
 at com.sun.org.apache.xerces.internal.parsers.XMLParser.parse(XMLParser.java:119)
 at com.sun.org.apache.xerces.internal.parsers.AbstractSAXParser.parse(AbstractSAXParser.java:1205)
 at com.sun.org.apache.xerces.internal.jaxp.SAXParserImpl$JAXPSAXParser.parse(SAXParserImpl.java:522)
 at org.xml.sax.helpers.XMLFilterImpl.parse(XMLFilterImpl.java:333)
 at org.apache.xalan.transformer.TransformerIdentityImpl.transform(TransformerIdentityImpl.java:452)
 at com.sun.xml.internal.messaging.saaj.util.transform.EfficientStreamingTransformer.transform(EfficientStreamingTransformer.java:393)
 at com.sun.xml.internal.messaging.saaj.soap.EnvelopeFactory.createEnvelope(EnvelopeFactory.java:102)
 at com.sun.xml.internal.messaging.saaj.soap.ver1_2.SOAPPart1_2Impl.createEnvelopeFromSource(SOAPPart1_2Impl.java:71)
 at com.sun.xml.internal.messaging.saaj.soap.SOAPPartImpl.getEnvelope(SOAPPartImpl.java:122)
 at com.sun.xml.internal.messaging.saaj.soap.MessageImpl.getSOAPHeader(MessageImpl.java:1261)
 at com.symantec.cas.ucf.sensors.ws_management.actions.AbstractSoapAction.init(AbstractSoapAction.java:133)
 at com.symantec.cas.ucf.sensors.ws_management.actions.AbstractSoapAction.<init>(AbstractSoapAction.java:127)
 at com.symantec.cas.ucf.sensors.ws_management.actions.PullAction$Response.<init>(PullAction.java:100)
 at com.symantec.cas.ucf.sensors.ws_management.actions.PullAction.setResponse(PullAction.java:52)
 at com.symantec.cas.ucf.sensors.ws_management.RequestBroker.readResponse(RequestBroker.java:329)
 at com.symantec.cas.ucf.sensors.ws_management.RequestBroker.sendRequest(RequestBroker.java:295)
 at com.symantec.cas.ucf.sensors.ws_management.WSManagementSensor.pullEvents(WSManagementSensor.java:468)
 at com.symantec.cas.ucf.sensors.ws_management.WSManagementSensor.readDevice(WSManagementSensor.java:384)
 at com.symantec.cas.ucf.collector.SensorJob.pollSensor(SensorJob.java:212)
 at com.symantec.cas.ucf.collector.SensorJob.run(SensorJob.java:292)
 at java.lang.Thread.run(Thread.java:662)
WARN 2012-09-13 16:31:08,966 Collectors.3301.wGroup.[workinggroup0].SensorThread Thread-17 [Sensor: OURDC2] Restarting the sensor...

Any idea?

Comments 6 CommentsJump to latest comment

Laurent_c's picture

Hi,

I noticed error with UTF-8

Are you running a machine with non english characters ? What country is the machine located ?

I have had issue in past with Russian, Turkish and other character and I had to chance the encoding of the Agent. See this KB Article URL http://www.symantec.com/docs/TECH143549

Laurent

Foxbilgi's picture

Yes we are located in Turkey but all regional setting is US and english for both server.

How can i change encoding of ssim event agent?

Foxbilgi's picture

Unfortunately it was'nt worked. I have changed

C:\Program Files (x86)\Common Files\Symantec Shared\SES\ses_work.properties

file as;

#This properties file is the common information for the various logging servlets for the system.
#Tue Sep 11 17:45:20 EEST 2012
-Dfile.encoding\=UTF-8
System.AgentJar=cimom.jar
System.AgentPolling=300
System.AgentVM=C\:\\Program Files (x86)\\Symantec\\Event Agent\\jre
System.CIMOMParams=-p 5998 -auto
System.CIMOMTimeout=300
System.AgentParams=-server -XX\:NewRatio\=3 -Xmx512m -Dnetworkaddress.cache.ttl\=300
System.AgentPath=C\:\\Program Files (x86)\\Symantec\\Event Agent

but nothing changed.

Laurent_c's picture

I need to improve KB.

The line you need to edit is this one :

System.AgentParams=-server -XX\:NewRatio\=3 -Xmx512m -Dfile.encoding\=UTF-8 -Dnetworkaddress.cache.ttl\=300

SOLUTION
Foxbilgi's picture

Great! Thanks Laurent, it works! I have two servers like that and both are now working well. Thanks again.