Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.

Vista Collector issue on 2008 R2 Domain Controller

Created: 13 Sep 2012 • Updated: 17 Sep 2012 | 6 comments
This issue has been solved. See solution.

Our vista collector stops after working for a while after installation. We have another DC with same collector configuration and it is working perfectly.

Here is the config of our 2008 R2 DC:

FIPS disabled.

Firewall disabled.

Certificate has imported succesfully with keytool.

WinRM

Config
    MaxEnvelopeSizekb = 150
    MaxTimeoutms = 60000
    MaxBatchItems = 32000
    MaxProviderRequests = 4294967295
    Client
        NetworkDelayms = 5000
        URLPrefix = wsman
        AllowUnencrypted = false
        Auth
            Basic = true
            Digest = true
            Kerberos = true
            Negotiate = true
            Certificate = true
            CredSSP = false
        DefaultPorts
            HTTP = 5985
            HTTPS = 5986
        TrustedHosts
    Service
        RootSDDL = O:NSG:BAD:P(A;;GA;;;BA)S:P(AU;FA;GA;;;WD)(AU;SA;GWGX;;;WD)
        MaxConcurrentOperations = 4294967295
        MaxConcurrentOperationsPerUser = 15
        EnumerationTimeoutms = 60000
        MaxConnections = 25
        MaxPacketRetrievalTimeSeconds = 120
        AllowUnencrypted = true
        Auth
            Basic = false
            Kerberos = true
            Negotiate = true
            Certificate = false
            CredSSP = false
            CbtHardeningLevel = Relaxed
        DefaultPorts
            HTTP = 5985
            HTTPS = 5986
        IPv4Filter = *
        IPv6Filter = *
        EnableCompatibilityHttpListener = false
        EnableCompatibilityHttpsListener = false
        CertificateThumbprint = 3b a1 08 1c 4a b7 ad 70  47 35 a8 50 e3 b7 46 e1dd 86 57 fd
    Winrs
        AllowRemoteShellAccess = true
        IdleTimeout = 180000
        MaxConcurrentUsers = 5
        MaxShellRunTime = 2147483647
        MaxProcessesPerShell = 15
        MaxMemoryPerShellMB = 150
        MaxShellsPerUser = 5

Logs are constanly produced;

Restarting the sensor...
WARN 2012-09-13 16:31:08,966 Collectors.3301.wGroup.[workinggroup0].SensorThread Thread-17 [Sensor: OURDC2] Exception in Sensor thread while reading device. Details:
com.sun.xml.internal.messaging.saaj.SOAPExceptionImpl: Unable to create envelope from given source:
 at com.sun.xml.internal.messaging.saaj.soap.EnvelopeFactory.createEnvelope(EnvelopeFactory.java:114)
 at com.sun.xml.internal.messaging.saaj.soap.ver1_2.SOAPPart1_2Impl.createEnvelopeFromSource(SOAPPart1_2Impl.java:71)
 at com.sun.xml.internal.messaging.saaj.soap.SOAPPartImpl.getEnvelope(SOAPPartImpl.java:122)
 at com.sun.xml.internal.messaging.saaj.soap.MessageImpl.getSOAPHeader(MessageImpl.java:1261)
 at com.symantec.cas.ucf.sensors.ws_management.actions.AbstractSoapAction.init(AbstractSoapAction.java:133)
 at com.symantec.cas.ucf.sensors.ws_management.actions.AbstractSoapAction.<init>(AbstractSoapAction.java:127)
 at com.symantec.cas.ucf.sensors.ws_management.actions.PullAction$Response.<init>(PullAction.java:100)
 at com.symantec.cas.ucf.sensors.ws_management.actions.PullAction.setResponse(PullAction.java:52)
 at com.symantec.cas.ucf.sensors.ws_management.RequestBroker.readResponse(RequestBroker.java:329)
 at com.symantec.cas.ucf.sensors.ws_management.RequestBroker.sendRequest(RequestBroker.java:295)
 at com.symantec.cas.ucf.sensors.ws_management.WSManagementSensor.pullEvents(WSManagementSensor.java:468)
 at com.symantec.cas.ucf.sensors.ws_management.WSManagementSensor.readDevice(WSManagementSensor.java:384)
 at com.symantec.cas.ucf.collector.SensorJob.pollSensor(SensorJob.java:212)
 at com.symantec.cas.ucf.collector.SensorJob.run(SensorJob.java:292)
 at java.lang.Thread.run(Thread.java:662)
Caused by: javax.xml.transform.TransformerException: com.sun.org.apache.xerces.internal.impl.io.MalformedByteSequenceException: Invalid byte 3 of 3-byte UTF-8 sequence.
 at org.apache.xalan.transformer.TransformerIdentityImpl.transform(TransformerIdentityImpl.java:473)
 at com.sun.xml.internal.messaging.saaj.util.transform.EfficientStreamingTransformer.transform(EfficientStreamingTransformer.java:393)
 at com.sun.xml.internal.messaging.saaj.soap.EnvelopeFactory.createEnvelope(EnvelopeFactory.java:102)
 ... 14 more
Caused by: com.sun.org.apache.xerces.internal.impl.io.MalformedByteSequenceException: Invalid byte 3 of 3-byte UTF-8 sequence.
 at com.sun.org.apache.xerces.internal.impl.io.UTF8Reader.invalidByte(UTF8Reader.java:684)
 at com.sun.org.apache.xerces.internal.impl.io.UTF8Reader.read(UTF8Reader.java:432)
 at com.sun.org.apache.xerces.internal.impl.XMLEntityScanner.load(XMLEntityScanner.java:1742)
 at com.sun.org.apache.xerces.internal.impl.XMLEntityScanner.skipChar(XMLEntityScanner.java:1416)
 at com.sun.org.apache.xerces.internal.impl.XMLDocumentFragmentScannerImpl$FragmentContentDriver.next(XMLDocumentFragmentScannerImpl.java:2792)
 at com.sun.org.apache.xerces.internal.impl.XMLDocumentScannerImpl.next(XMLDocumentScannerImpl.java:648)
 at com.sun.org.apache.xerces.internal.impl.XMLNSDocumentScannerImpl.next(XMLNSDocumentScannerImpl.java:140)
 at com.sun.org.apache.xerces.internal.impl.XMLDocumentFragmentScannerImpl.scanDocument(XMLDocumentFragmentScannerImpl.java:511)
 at com.sun.org.apache.xerces.internal.parsers.XML11Configuration.parse(XML11Configuration.java:808)
 at com.sun.org.apache.xerces.internal.parsers.XML11Configuration.parse(XML11Configuration.java:737)
 at com.sun.org.apache.xerces.internal.parsers.XMLParser.parse(XMLParser.java:119)
 at com.sun.org.apache.xerces.internal.parsers.AbstractSAXParser.parse(AbstractSAXParser.java:1205)
 at com.sun.org.apache.xerces.internal.jaxp.SAXParserImpl$JAXPSAXParser.parse(SAXParserImpl.java:522)
 at org.xml.sax.helpers.XMLFilterImpl.parse(XMLFilterImpl.java:333)
 at org.apache.xalan.transformer.TransformerIdentityImpl.transform(TransformerIdentityImpl.java:452)
 ... 16 more

CAUSE:

javax.xml.transform.TransformerException: com.sun.org.apache.xerces.internal.impl.io.MalformedByteSequenceException: Invalid byte 3 of 3-byte UTF-8 sequence.
 at org.apache.xalan.transformer.TransformerIdentityImpl.transform(TransformerIdentityImpl.java:473)
 at com.sun.xml.internal.messaging.saaj.util.transform.EfficientStreamingTransformer.transform(EfficientStreamingTransformer.java:393)
 at com.sun.xml.internal.messaging.saaj.soap.EnvelopeFactory.createEnvelope(EnvelopeFactory.java:102)
 at com.sun.xml.internal.messaging.saaj.soap.ver1_2.SOAPPart1_2Impl.createEnvelopeFromSource(SOAPPart1_2Impl.java:71)
 at com.sun.xml.internal.messaging.saaj.soap.SOAPPartImpl.getEnvelope(SOAPPartImpl.java:122)
 at com.sun.xml.internal.messaging.saaj.soap.MessageImpl.getSOAPHeader(MessageImpl.java:1261)
 at com.symantec.cas.ucf.sensors.ws_management.actions.AbstractSoapAction.init(AbstractSoapAction.java:133)
 at com.symantec.cas.ucf.sensors.ws_management.actions.AbstractSoapAction.<init>(AbstractSoapAction.java:127)
 at com.symantec.cas.ucf.sensors.ws_management.actions.PullAction$Response.<init>(PullAction.java:100)
 at com.symantec.cas.ucf.sensors.ws_management.actions.PullAction.setResponse(PullAction.java:52)
 at com.symantec.cas.ucf.sensors.ws_management.RequestBroker.readResponse(RequestBroker.java:329)
 at com.symantec.cas.ucf.sensors.ws_management.RequestBroker.sendRequest(RequestBroker.java:295)
 at com.symantec.cas.ucf.sensors.ws_management.WSManagementSensor.pullEvents(WSManagementSensor.java:468)
 at com.symantec.cas.ucf.sensors.ws_management.WSManagementSensor.readDevice(WSManagementSensor.java:384)
 at com.symantec.cas.ucf.collector.SensorJob.pollSensor(SensorJob.java:212)
 at com.symantec.cas.ucf.collector.SensorJob.run(SensorJob.java:292)
 at java.lang.Thread.run(Thread.java:662)
Caused by: com.sun.org.apache.xerces.internal.impl.io.MalformedByteSequenceException: Invalid byte 3 of 3-byte UTF-8 sequence.
 at com.sun.org.apache.xerces.internal.impl.io.UTF8Reader.invalidByte(UTF8Reader.java:684)
 at com.sun.org.apache.xerces.internal.impl.io.UTF8Reader.read(UTF8Reader.java:432)
 at com.sun.org.apache.xerces.internal.impl.XMLEntityScanner.load(XMLEntityScanner.java:1742)
 at com.sun.org.apache.xerces.internal.impl.XMLEntityScanner.skipChar(XMLEntityScanner.java:1416)
 at com.sun.org.apache.xerces.internal.impl.XMLDocumentFragmentScannerImpl$FragmentContentDriver.next(XMLDocumentFragmentScannerImpl.java:2792)
 at com.sun.org.apache.xerces.internal.impl.XMLDocumentScannerImpl.next(XMLDocumentScannerImpl.java:648)
 at com.sun.org.apache.xerces.internal.impl.XMLNSDocumentScannerImpl.next(XMLNSDocumentScannerImpl.java:140)
 at com.sun.org.apache.xerces.internal.impl.XMLDocumentFragmentScannerImpl.scanDocument(XMLDocumentFragmentScannerImpl.java:511)
 at com.sun.org.apache.xerces.internal.parsers.XML11Configuration.parse(XML11Configuration.java:808)
 at com.sun.org.apache.xerces.internal.parsers.XML11Configuration.parse(XML11Configuration.java:737)
 at com.sun.org.apache.xerces.internal.parsers.XMLParser.parse(XMLParser.java:119)
 at com.sun.org.apache.xerces.internal.parsers.AbstractSAXParser.parse(AbstractSAXParser.java:1205)
 at com.sun.org.apache.xerces.internal.jaxp.SAXParserImpl$JAXPSAXParser.parse(SAXParserImpl.java:522)
 at org.xml.sax.helpers.XMLFilterImpl.parse(XMLFilterImpl.java:333)
 at org.apache.xalan.transformer.TransformerIdentityImpl.transform(TransformerIdentityImpl.java:452)
 ... 16 more
---------
com.sun.org.apache.xerces.internal.impl.io.MalformedByteSequenceException: Invalid byte 3 of 3-byte UTF-8 sequence.
 at com.sun.org.apache.xerces.internal.impl.io.UTF8Reader.invalidByte(UTF8Reader.java:684)
 at com.sun.org.apache.xerces.internal.impl.io.UTF8Reader.read(UTF8Reader.java:432)
 at com.sun.org.apache.xerces.internal.impl.XMLEntityScanner.load(XMLEntityScanner.java:1742)
 at com.sun.org.apache.xerces.internal.impl.XMLEntityScanner.skipChar(XMLEntityScanner.java:1416)
 at com.sun.org.apache.xerces.internal.impl.XMLDocumentFragmentScannerImpl$FragmentContentDriver.next(XMLDocumentFragmentScannerImpl.java:2792)
 at com.sun.org.apache.xerces.internal.impl.XMLDocumentScannerImpl.next(XMLDocumentScannerImpl.java:648)
 at com.sun.org.apache.xerces.internal.impl.XMLNSDocumentScannerImpl.next(XMLNSDocumentScannerImpl.java:140)
 at com.sun.org.apache.xerces.internal.impl.XMLDocumentFragmentScannerImpl.scanDocument(XMLDocumentFragmentScannerImpl.java:511)
 at com.sun.org.apache.xerces.internal.parsers.XML11Configuration.parse(XML11Configuration.java:808)
 at com.sun.org.apache.xerces.internal.parsers.XML11Configuration.parse(XML11Configuration.java:737)
 at com.sun.org.apache.xerces.internal.parsers.XMLParser.parse(XMLParser.java:119)
 at com.sun.org.apache.xerces.internal.parsers.AbstractSAXParser.parse(AbstractSAXParser.java:1205)
 at com.sun.org.apache.xerces.internal.jaxp.SAXParserImpl$JAXPSAXParser.parse(SAXParserImpl.java:522)
 at org.xml.sax.helpers.XMLFilterImpl.parse(XMLFilterImpl.java:333)
 at org.apache.xalan.transformer.TransformerIdentityImpl.transform(TransformerIdentityImpl.java:452)
 at com.sun.xml.internal.messaging.saaj.util.transform.EfficientStreamingTransformer.transform(EfficientStreamingTransformer.java:393)
 at com.sun.xml.internal.messaging.saaj.soap.EnvelopeFactory.createEnvelope(EnvelopeFactory.java:102)
 at com.sun.xml.internal.messaging.saaj.soap.ver1_2.SOAPPart1_2Impl.createEnvelopeFromSource(SOAPPart1_2Impl.java:71)
 at com.sun.xml.internal.messaging.saaj.soap.SOAPPartImpl.getEnvelope(SOAPPartImpl.java:122)
 at com.sun.xml.internal.messaging.saaj.soap.MessageImpl.getSOAPHeader(MessageImpl.java:1261)
 at com.symantec.cas.ucf.sensors.ws_management.actions.AbstractSoapAction.init(AbstractSoapAction.java:133)
 at com.symantec.cas.ucf.sensors.ws_management.actions.AbstractSoapAction.<init>(AbstractSoapAction.java:127)
 at com.symantec.cas.ucf.sensors.ws_management.actions.PullAction$Response.<init>(PullAction.java:100)
 at com.symantec.cas.ucf.sensors.ws_management.actions.PullAction.setResponse(PullAction.java:52)
 at com.symantec.cas.ucf.sensors.ws_management.RequestBroker.readResponse(RequestBroker.java:329)
 at com.symantec.cas.ucf.sensors.ws_management.RequestBroker.sendRequest(RequestBroker.java:295)
 at com.symantec.cas.ucf.sensors.ws_management.WSManagementSensor.pullEvents(WSManagementSensor.java:468)
 at com.symantec.cas.ucf.sensors.ws_management.WSManagementSensor.readDevice(WSManagementSensor.java:384)
 at com.symantec.cas.ucf.collector.SensorJob.pollSensor(SensorJob.java:212)
 at com.symantec.cas.ucf.collector.SensorJob.run(SensorJob.java:292)
 at java.lang.Thread.run(Thread.java:662)
WARN 2012-09-13 16:31:08,966 Collectors.3301.wGroup.[workinggroup0].SensorThread Thread-17 [Sensor: OURDC2] Restarting the sensor...

Any idea?

Comments 6 CommentsJump to latest comment

Laurent_c's picture

Hi,

I noticed error with UTF-8

Are you running a machine with non english characters ? What country is the machine located ?

I have had issue in past with Russian, Turkish and other character and I had to chance the encoding of the Agent. See this KB Article URL http://www.symantec.com/docs/TECH143549

Laurent

Foxbilgi's picture

Yes we are located in Turkey but all regional setting is US and english for both server.

How can i change encoding of ssim event agent?

Foxbilgi's picture

Unfortunately it was'nt worked. I have changed

C:\Program Files (x86)\Common Files\Symantec Shared\SES\ses_work.properties

file as;

#This properties file is the common information for the various logging servlets for the system.
#Tue Sep 11 17:45:20 EEST 2012
-Dfile.encoding\=UTF-8
System.AgentJar=cimom.jar
System.AgentPolling=300
System.AgentVM=C\:\\Program Files (x86)\\Symantec\\Event Agent\\jre
System.CIMOMParams=-p 5998 -auto
System.CIMOMTimeout=300
System.AgentParams=-server -XX\:NewRatio\=3 -Xmx512m -Dnetworkaddress.cache.ttl\=300
System.AgentPath=C\:\\Program Files (x86)\\Symantec\\Event Agent

but nothing changed.

Laurent_c's picture

I need to improve KB.

The line you need to edit is this one :

System.AgentParams=-server -XX\:NewRatio\=3 -Xmx512m -Dfile.encoding\=UTF-8 -Dnetworkaddress.cache.ttl\=300

SOLUTION
Foxbilgi's picture

Great! Thanks Laurent, it works! I have two servers like that and both are now working well. Thanks again.