Crash of altiris agent

[Migration User]

Hi I have the probably latest version of Altiris Agent installed on my pc which instantly crashes. The version is 7.0.1649.8649 With Raad2 I can access the logfile. It shows me the following errors when starting the agent:

 <event date="Feb 11 16:14:12" hostname="PIDxxxxxxx" module="AeXNSAgent.exe" pid="5272" process="AeXNSAgent.exe" severity="2" source="Altiris Agent" thread="3548" tickcount="11634304"><!--[CDATA[SymFromAddr encountered an error resolving ㈰㡄ぁ㈰ from module 
Error code 126: The specified module could not be found]]--></event> (The cryptic signs are like that in the logfile!) <event date="Feb 11 16:14:12" hostname="PID1011385" module="AeXNSAgent.exe" pid="5272" process="AeXNSAgent.exe" severity="1" source="Altiris Agent" thread="3548" tickcount="11634304"><!--[CDATA[
Exception - Access Violation: C0000005

Bit Flag: 00000000 - Memory Address Accessed: 56413F2E : 021BF838

EAX=56413F2E EBX=00000000 ECX=02D80F70 EDX=56413F30 ESI=02D80F70
EDI=56413F2E EBP=021BFB58 ESP=021BFB58 EIP=75D54660 FLG=00010206
CS=0023 DS=002B SS=002B ES=002B FS=0053 GS=002B
Stack dump: 

Stack Trace 
75D54660 (SysAllocString) : C:\Windows\syswow64\OLEAUT32.dll
02CA72FC (GetInventory) : C:\Program Files (x86)\Altiris\Altiris Agent\AeXBasicInventory.dll
]]--></event>

Any idea what the reason for this error could be? OS is Win7 X64 with all updates installed. Thanks, pato

[Migration User]

I'm sorry, what error?  If it's not uploading correctly due to odd characters, perhaps you can upload a screenshot.

[Migration User]

Oh indeed, lol didn't check my own post. It was posted as text, but I guess the forum software deleted it. I've added them now as an attachement.

Attachment(s)

Agent_stripped.txt   2 KB 1 version

[Migration User]

There's a known issue described in this KB which seems to apply:
http://www.symantec.com/business/support/index?page=content&id=TECH143680

You should have a more current version of the SMA available, however -- though I think it would still match what's in the KB.  Are you running SP5 on your server?  If so, does this agent appear to the server as having an agent requiring an upgrade?  If so, you should enable the upgrade policy.

[Migration User]

Ah thanks, indeed looks like my issue. I beleive the server runs SP5, but I have to ask the admin for that. I don't know regarding the SMA agent, but we updated like two weeks ago, together with Symantec (we have several issues with our NS and are because of that always in contact with Symantec).

[Migration User]

A little admin magic and I got the error to show up

Cheryl

[Migration User]

We updated now to the latest Agent (7.0.1703.8705) and it still crashes. On the positive side, I get now a dump file ;)

Can I somehow open this dump file and debug it myself? The dump is 130MB in size.

I've opened it in windbg and get this as a result:

This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(1a40.5a0): Access violation - code c0000005 (first/second chance not available)
eax=00000000 ebx=00000000 ecx=02e40f70 edx=56413f30 esi=000006f4 edi=00000000
eip=770ff861 esp=0220f430 ebp=0220f49c iopl=0         nv up ei pl nz na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00210206
ntdll!ZwWaitForSingleObject+0x15:
770ff861 83c404          add     esp,4

0:006> .ecxr
eax=56413f2e ebx=00000000 ecx=02e40f70 edx=56413f30 esi=02e40f70 edi=56413f2e
eip=74ab4660 esp=0220fb24 ebp=0220fb24 iopl=0         nv up ei pl nz na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00210206
oleaut32!SysAllocString+0x15:
74ab4660 668b08          mov     cx,word ptr [eax]        ds:002b:56413f2e=????
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for AeXBasicInventory.dll -

[Migration User]

Try to uninstall and then reinstall on a test agent.  Entire agent removed and all plugins (/clean) and then reinstall.

[Migration User]

It's actually only my machine where it's not working, it's working on like 1000 other computers :(

I'm trying to search further...

[Migration User]

Some more details:

FAULTING_IP:
oleaut32!SysAllocString+15
75174660 668b08          mov     cx,word ptr [eax]

EXCEPTION_RECORD:  ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 75174660 (oleaut32!SysAllocString+0x00000015)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000000
   Parameter[1]: 56413f2e
Attempt to read from address 56413f2e

DEFAULT_BUCKET_ID:  INVALID_POINTER_READ

PROCESS_NAME:  AeXNSAgent.exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  00000000

EXCEPTION_PARAMETER2:  56413f2e

READ_ADDRESS:  56413f2e

FOLLOWUP_IP:
oleaut32!SysAllocString+15
75174660 668b08          mov     cx,word ptr [eax]

NTGLOBALFLAG:  0

APPLICATION_VERIFIER_FLAGS:  0

FAULTING_THREAD:  0000119c

PRIMARY_PROBLEM_CLASS:  INVALID_POINTER_READ

BUGCHECK_STR:  APPLICATION_FAULT_INVALID_POINTER_READ

LAST_CONTROL_TRANSFER:  from 02b9732c to 75174660

STACK_TEXT: 
0214fb24 02b9732c 56413f2e 84646a75 02e00c78 oleaut32!SysAllocString+0x15
WARNING: Stack unwind information not available. Following frames may be wrong.
0214fb64 02b9f5b6 00000003 56413f2e 84646a39 AeXBasicInventory!GetInventory+0x1c2c
0214fbb4 02b9f968 02e0831c 02e00c78 84646d79 AeXBasicInventory!GetInventory+0x9eb6
0214fc38 02b97886 84646dcd 02e02b30 02e00f70 AeXBasicInventory!GetInventory+0xa268
0214fc8c 02b98dbe 06a52b40 84646d95 0214fd20 AeXBasicInventory!GetInventory+0x2186
0214fcd4 02b995bb 06a52b40 84646c45 0214fd68 AeXBasicInventory!GetInventory+0x36be
0214fd04 00433482 02e02c60 0214fcdc 849f29cd AeXBasicInventory!GetInventory+0x3ebb
0214fd30 00433eb1 849f2901 00be98a8 00be997c AeXNSAgent+0x33482
0214fdfc 0042564a 849f2a0d 004ff169 00be98a8 AeXNSAgent+0x33eb1
0214fef0 00484f8c 849f2bb9 00000000 00bea3c8 AeXNSAgent+0x2564a
0214ff44 004b9b84 00be98a8 849f2b81 00000000 AeXNSAgent+0x84f8c
0214ff7c 004b9c2c 00000000 0214ff94 74d133ca AeXNSAgent+0xb9b84
0214ff88 74d133ca 00bea3c8 0214ffd4 76ed9ed2 AeXNSAgent+0xb9c2c
0214ff94 76ed9ed2 00bea3c8 743458c6 00000000 kernel32!BaseThreadInitThunk+0xe
0214ffd4 76ed9ea5 004b9baa 00bea3c8 00000000 ntdll!__RtlUserThreadStart+0x70
0214ffec 00000000 004b9baa 00bea3c8 00000000 ntdll!_RtlUserThreadStart+0x1b

STACK_COMMAND:  ~6s; .ecxr ; kb

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  oleaut32!SysAllocString+15

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: oleaut32

IMAGE_NAME:  oleaut32.dll

DEBUG_FLR_IMAGE_TIMESTAMP:  4ce7b972

FAILURE_BUCKET_ID:  INVALID_POINTER_READ_c0000005_oleaut32.dll!SysAllocString

BUCKET_ID:  APPLICATION_FAULT_INVALID_POINTER_READ_oleaut32!SysAllocString+15

I've verified the file oleaut32.dll and the md5 sum is the same as from a different computer. Also a sfc.exe /scannow didn't reveal anything broken :(

[Migration User]

Wow I solved it :)

It seems to be a bug in Altiris Agent when it's analyzing the Services on the computer. I had a "broken" service ('Smart Card' had as Startup Type just an empty field). I've fixed it by configuring it to Manual. After that I could start Altiris Agent (didn't start Smart Card) and is working now again :)

It seems the Agent has a bug when checking for the list of services while making the Inventory.

[Migration User]

Thanks for posting your solution!  It may help someone else.

[Migration User]

Hi,

Altiris Agent status is shutting down.both side communication is ok.

 

plz give me solution..

 

 

 

Shiva

[e-mail]