ESET PROTECT 9 started crashing today

[mrac 5]

Hello.

Latest version of ESET Protect 9 was installed, worked without issues until today.

Server was upgraded ERA6 -> ESMC7 -> ERA Protect 8 -> ERA Protect 9 (when they were released, not at once). Working on Windows 2012R2 + MSSQL2019 (another server).

Yesterday I made changes:

1. Enabled advanced security, regenerated CA, server, agent, proxy certificates.

2. Changed Sever certificate. Agent certificates in agent policy.

3. Enabled 2FA for all admins.

It worked without issues about 24 hours. And crashed today. Restarting of service/complete server not helping, crashing again:

The ESET PROTECT Server service terminated unexpectedly.  It has done this 10 time(s).

Not found something in logs (but attaching them + dumps). I'm out of ideas...

Eset.zip

[Marcos 5,466]

We suspect today's update of the translation support module to cause the issue and working on further investigation. We'll keep you posted about the development.

[tomasS 5]

Dear Mrac,

in case your server is still not operable, you can fix it by reverting to the previous build of the Translator module - this can be done by stopping the PROTECT/ESMC Server(I believe this is already done), create a backup of the following files/folder:

Windows:

C:\ProgramData\ESET\RemoteAdministrator\Server\EraServerApplicationData\Modules\em017_64\

Linux

/var/opt/eset/RemoteAdministrator/Server/Modules/em017_64.dat

Remove all folders which are in the following path(in case of Windows):

"C:\ProgramData\ESET\RemoteAdministrator\Server\EraServerApplicationData\Modules\em017_64\"

In case of Linux remove the "em017_64.dat" file

Execute the repair of the PROTECT server - it should re-create the "Translator" module file from the installation archive(it will be older version of the Translator module which comes with the installers/is build in the installer)

Windows:

just execute the MSI installer which can be found at "C:\ProgramData\ESET\RemoteAdministrator\Server\SetupData\Installer" and pick repair installation(you will be asked for DB credentials...)

Linux:

execute the installation script: opt/eset/RemoteAdministrator/Server/setup/installer_backup.sh

It will automatically execute the "repair" and create deleted files...

 

 

Edited December 13, 2021 by tomasS

[mrac 5]

Thank you for fast answer and solution. Very appreciated. This helped to fix issue.

Edited December 13, 2021 by mrac

[mrac 5]

Too soon wrote, that all working. After repair server started, but all agents cannot connect to it. All has last connection time when server failed.

In logs:

2021-12-13 15:54:17 Information: CDatabaseModule [Thread 1f7c]: ReplicationStaticObjectsMapper: Finnished batch loading of COMPUTER objects
2021-12-13 15:54:17 Information: CDatabaseModule [Thread 1f7c]: ReplicationStaticObjectsMapper: Fetching all CLIENT_TASK_TO_COMPUTER_RELATION, CLIENT_TASK_TO_DYNAMIC_GROUP_RELATION and CLIENT_TASK_TO_STATIC_GROUP_RELATION objects
2021-12-13 15:54:17 Error: NetworkModule [Thread 20bc]: Receive: NodSslWriteEncryptedData: Internal error in the underlying implementations., ResolvedIpAddress:128.74.107.155, ResolvedHostname:128-74-107-155.broadband.corbina.ru, ResolvedPort:63541
2021-12-13 15:54:17 Error: NetworkModule [Thread 20bc]: Protocol failure for session id 3383, error:Receive: NodSslWriteEncryptedData: Internal error in the underlying implementations.
2021-12-13 15:54:17 Information: NetworkModule [Thread ac4]: Sending message: ConnectionFailure
2021-12-13 15:54:17 Information: NetworkModule [Thread 20bc]: Forcibly closing sessionId:3383, isClosing:0
2021-12-13 15:54:17 Information: NetworkModule [Thread 20bc]: Removing session 3383
2021-12-13 15:54:17 Information: NetworkModule [Thread 20bc]: Closing connection , session id:3383

 

[mrac 5]

Fixed by restoring database from backup. Not sure what happened, but fixed...