Jump to content

ESET PROTECT 9 started crashing today


mrac
 Share

Go to solution Solved by tomasS,

Recommended Posts

Hello.

Latest version of ESET Protect 9 was installed, worked without issues until today.

Server was upgraded ERA6 -> ESMC7 -> ERA Protect 8 -> ERA Protect 9 (when they were released, not at once). Working on Windows 2012R2 + MSSQL2019 (another server).

Yesterday I made changes:

1. Enabled advanced security, regenerated CA, server, agent, proxy certificates.

2. Changed Sever certificate. Agent certificates in agent policy.

3. Enabled 2FA for all admins.

It worked without issues about 24 hours. And crashed today. Restarting of service/complete server not helping, crashing again:

The ESET PROTECT Server service terminated unexpectedly.  It has done this 10 time(s).

Not found something in logs (but attaching them + dumps). I'm out of ideas...

Eset.zip

Link to comment
Share on other sites

  • Administrators

We suspect today's update of the translation support module to cause the issue and working on further investigation. We'll keep you posted about the development.

Link to comment
Share on other sites

  • ESET Support
  • Solution

Dear Mrac,

in case your server is still not operable, you can fix it by reverting to the previous build of the Translator module - this can be done by stopping the PROTECT/ESMC Server(I believe this is already done), create a backup of the following files/folder:

Windows:

C:\ProgramData\ESET\RemoteAdministrator\Server\EraServerApplicationData\Modules\em017_64\

Linux

/var/opt/eset/RemoteAdministrator/Server/Modules/em017_64.dat

Remove all folders which are in the following path(in case of Windows):

"C:\ProgramData\ESET\RemoteAdministrator\Server\EraServerApplicationData\Modules\em017_64\"

In case of Linux remove the "em017_64.dat" file

Execute the repair of the PROTECT server - it should re-create the "Translator" module file from the installation archive(it will be older version of the Translator module which comes with the installers/is build in the installer)

Windows:

just execute the MSI installer which can be found at "C:\ProgramData\ESET\RemoteAdministrator\Server\SetupData\Installer" and pick repair installation(you will be asked for DB credentials...)

Linux:

execute the installation script: opt/eset/RemoteAdministrator/Server/setup/installer_backup.sh

It will automatically execute the "repair" and create deleted files...

 

 

Edited by tomasS
Link to comment
Share on other sites

Too soon wrote, that all working. After repair server started, but all agents cannot connect to it. All has last connection time when server failed.

In logs:

2021-12-13 15:54:17 Information: CDatabaseModule [Thread 1f7c]: ReplicationStaticObjectsMapper: Finnished batch loading of COMPUTER objects
2021-12-13 15:54:17 Information: CDatabaseModule [Thread 1f7c]: ReplicationStaticObjectsMapper: Fetching all CLIENT_TASK_TO_COMPUTER_RELATION, CLIENT_TASK_TO_DYNAMIC_GROUP_RELATION and CLIENT_TASK_TO_STATIC_GROUP_RELATION objects
2021-12-13 15:54:17 Error: NetworkModule [Thread 20bc]: Receive: NodSslWriteEncryptedData: Internal error in the underlying implementations., ResolvedIpAddress:128.74.107.155, ResolvedHostname:128-74-107-155.broadband.corbina.ru, ResolvedPort:63541
2021-12-13 15:54:17 Error: NetworkModule [Thread 20bc]: Protocol failure for session id 3383, error:Receive: NodSslWriteEncryptedData: Internal error in the underlying implementations.
2021-12-13 15:54:17 Information: NetworkModule [Thread ac4]: Sending message: ConnectionFailure
2021-12-13 15:54:17 Information: NetworkModule [Thread 20bc]: Forcibly closing sessionId:3383, isClosing:0
2021-12-13 15:54:17 Information: NetworkModule [Thread 20bc]: Removing session 3383
2021-12-13 15:54:17 Information: NetworkModule [Thread 20bc]: Closing connection , session id:3383

 

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...