ESET file security 7.3.12006 - Citrix PVS - hang during boot

[Erlend 0]

Hi

 

After upgrading file security from 7.3.12005 to 7.3.12006 we are experiences a high number of hang during reboot from network. (Citrix PVS)

any known issues with this version that would cause this ?

since this is non-persistent there are no logs as standard, and we would need to redirect the needed logs to persistent storage.

[Marcos 5,070]

There are no such known issues. Does temporarily disabling real-time protection in the advanced setup and/or disabling HIPS and rebooting the server make a difference?  If not, try temporarily uninstalling EFSW to make sure that it actually resolves the issue; otherwise you'll need to look for the root cause elsewhere. If you confirm that EFSW is somehow causing the issue, please open a support ticket with your local ESET distributor and provide your findings as well as logs collected with ESET Log Collector for a start.

A complete memory dump from the freeze will be most likely needed to determine the cause.

[Erlend 0]

Hi, as stated it Citrix PVS, so non-persistent, only option is to update the image with one of the following changes:

-downgrade FS to the previous version 7.3.12005 (re-install with this version)
-uninstall FS, not an option
-uninstall component, by component HIPS, Network protection 

we have 6 other images with older version of FS without the issue.

[Erlend 0]

8 minutes ago, Marcos said:

There are no such known issues. Does temporarily disabling real-time protection in the advanced setup and/or disabling HIPS and rebooting the server make a difference?  If not, try temporarily uninstalling EFSW to make sure that it actually resolves the issue; otherwise you'll need to look for the root cause elsewhere. If you confirm that EFSW is somehow causing the issue, please open a support ticket with your local ESET distributor and provide your findings as well as logs collected with ESET Log Collector for a start.

A complete memory dump from the freeze will be most likely needed to determine the cause.

local support have always been slooooow, and eset log collector won't help, since it's non persistent. 

[Erlend 0]

disabling HIPS 7.3.12006 seems to resolve the issue, but we use HIPS with 7.3.12005, so something must have changed.

we will run some more tests, but HIPS seems to be the source of the issue.

[Marcos 5,070]

We'll most likely need a complete memory dump from time when the system hangs. While I'm not versed in Citrix, I've heard that it's possible to change persistent to non-persistent desktops and vice-versa and even our tech support advised so to our users in the past when it was necessary to get a memory dump for instance.

Did you make the desktop persistent given that you narrowed it to HIPS? Disabling HIPS requires a computer restart so with a non-persistent desktop you would not be able to disable it, would you?