Jump to content
CMOS

ESET 7.1.12006.0 on Windows HYPER-V host and DPM issues - backup jobs are failing

Recommended Posts

Dear all,

My best wishes for a happy new year to everyone!

I would like your support for a strange issue that we have been experiencing recently. We upgraded many of our Windows server 2012 R2 datacenter hosts from ESET file security 6.5.something to the ESET file security 7.1.12006.0 and since then all backup jobs were failing. We are using Microsoft DPM 2016 for performing backups of virtual machines on hyper v hosts and with 6.5 version everything was working fine without any further configuration. 

Below some further info to help you understand the case:

  • we restarted the servers multiple times after installation
  • once we remove eset file security 7.1 all backups are working fine
  • firewall rules on windows are set properly.
  • tried to install all windows updates
  • tried to disable all features of file security one by one without success

in some cases i was also experiencing issues like those described for 6.5 version here https://support.eset.com/en/system-is-unresponsive-or-crashes-with-eset-products-installed-era-62

as i have very limited maintenance windows and i cannot perform safe troubleshooting with try and error i would appreciate if someone else can share his experience or thoughts.

below the installed components that we have:

Detection Engine: 20606 (20200102)
Rapid Response module: 15502 (20200102)
Update module: 1018.1 (20190709)
Antivirus and antispyware scanner module: 1557.6 (20191218)
Advanced heuristics module: 1196 (20191108)
Archive support module: 1296 (20191212)
Cleaner module: 1205 (20191209)
Anti-Stealth support module: 1156.1 (20191216)
Firewall module: 1396.1 (20191223)
ESET SysInspector module: 1275 (20181220)
Translation support module: 1777 (20191128)
HIPS support module: 1379.2 (20191218)
Internet protection module: 1380 (20190920)
Database module: 1110 (20190827)
Configuration module (36): 1811.6 (20191029)
LiveGrid communication module: 1055 (20191107)
Specialized cleaner module: 1013 (20190627)
Rootkit detection and cleaning module: 1019 (20170825)
Network protection module: 1682 (20190801)
Script scanner module: 1062 (20191204)
Connected Home Network module: 1035 (20191112)
Cryptographic protocol support module: 1040 (20190913)
Advanced Machine Learning module: 1045 (20191211)

Share this post


Link to post
Share on other sites

The only issue related to backup that we are aware of is the following error:

Error: Windows Backup failed to get an exclusive lock on the EFI system partition (ESP).

Could you confirm or deny that your issue is like that? If your issue is different, I'd recommend raising a support ticket with customer care.

Share this post


Link to post
Share on other sites

No, its not an issue relevant to Error: Windows Backup failed to get an exclusive lock on the EFI system partition (ESP).

there is no message in eset or windows that could indicate something to help

Share this post


Link to post
Share on other sites

Since upgrading to 7.1.12006.0 on our clients HyperV hosts (and others), we are also seeing similar issues. Backup jobs wont finish in DPM. They are all in an inconsistent state and wont complete. Previous versions were all over place 7.0/6.X

DPM backups that occur direct to a VM (like exchange DB backup, or SQL DB backup work fine. Just any that connect to HyperV to do child backup fail. 

Client is using DPM 2012. 

The hyperv servers have been noted as having following error reported since upgrade occurs once a day. 

 

Faulting application name: DPMRA.exe, version: 4.1.3465.0, time stamp: 0x543d17c5
Faulting module name: KERNELBASE.dll, version: 6.2.9200.22376, time stamp: 0x5a90c314
Exception code: 0x809909c2
Fault offset: 0x000000000000a06c
Faulting process id: 0x6558
Faulting application start time: 0x01d5c85676a6839c
Faulting application path: C:\Program Files\Microsoft Data Protection Manager\DPM\bin\DPMRA.exe
Faulting module path: C:\Windows\system32\KERNELBASE.dll
Report Id: 3931d558-34af-11ea-941c-2880239f7767
Faulting package full name: 
Faulting package-relative application ID: 

Edited by Ricky Taylor

Share this post


Link to post
Share on other sites

I would recommend opening a support ticket and providing:
- logs collected with ESET Log Collector
- a Procmon log created when the issue occurs; make sure to temporarily disable protection service in the HIPS setup and reboot the system.

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...