Thomas Fincke 0 Posted April 24, 2023 Author Share Posted April 24, 2023 So far there have been no further crashes, we are waiting and have also opened a case with support. Link to comment Share on other sites More sharing options...
Thomas Fincke 0 Posted April 24, 2023 Author Share Posted April 24, 2023 A reinstallation of ESET has unfortunately brought nothing, had the problem just again (after 10 days on this server). Link to comment Share on other sites More sharing options...
Administrators Marcos 5,231 Posted April 24, 2023 Administrators Share Posted April 24, 2023 The issue would occur if the catalog gets corrupt for whatever reason. Please check C:\Windows\System32\catroot2\dberr.txt if it contains some recent catalog errors. Link to comment Share on other sites More sharing options...
EranBix 0 Posted April 25, 2023 Share Posted April 25, 2023 We are facing the same problem at Windows Serwer 2012 r2 and Windows Serwer 2016 and Windows Serwer 2019 with Remote Destkop Licences after updating Eset to ver 10. At some servers we downgrade to version 9 ----------------------------- To people with Eset Version 10 Solution to restart server is: sc queryex senstaskkill /PID XXXX /f then You can do restart not hard restart server. U can also start this service (sens) without restart but serwer will have still problems. Link to comment Share on other sites More sharing options...
Administrators Marcos 5,231 Posted April 25, 2023 Administrators Share Posted April 25, 2023 5 hours ago, EranBix said: We are facing the same problem at Windows Serwer 2012 r2 and Windows Serwer 2016 and Windows Serwer 2019 with Remote Destkop Licences after updating Eset to ver 10. Please create a new topic and describe the issue in detail. The issue being discussed in this topic is about ekrn.exe not starting with Windows at times, however, v10 is not affected since it has certain Microsoft dlls signed by ESET to prevent long verification on system startup. Link to comment Share on other sites More sharing options...
Thomas Fincke 0 Posted April 25, 2023 Author Share Posted April 25, 2023 1 hour ago, Marcos said: Please create a new topic and describe the issue in detail. The issue being discussed in this topic is about ekrn.exe not starting with Windows at times, however, v10 is not affected since it has certain Microsoft dlls signed by ESET to prevent long verification on system startup. @ Marcos: that is not correct. We have the problems with version 10. And we don't have problems at start-up, but during use. So this is probably another case and it could be a bigger problem at ESET. Link to comment Share on other sites More sharing options...
Dante_sch 0 Posted April 25, 2023 Share Posted April 25, 2023 (edited) Same problem! Server 2012 r2 with RDS and ESET V10.0.12010.0 ekrn.exe causes windows logon application to hang. Users unable to logoff, get message "Please wait for the system event notification service". Have to restart server to resolve temporarily. Also causes issues with windows explorer and taskbar. I will try to downgrade to v9 and see if it resolves the issue for us. Edited April 25, 2023 by Dante_sch Link to comment Share on other sites More sharing options...
Administrators Marcos 5,231 Posted April 25, 2023 Administrators Share Posted April 25, 2023 Please generate a complete memory dump as per https://support.eset.com/en/kb380 when the system is stuck at "Please wait for the system event notification service". Link to comment Share on other sites More sharing options...
Jarvick Castillo 0 Posted April 25, 2023 Share Posted April 25, 2023 Hi we have de message in C:\Windows\System32\catroot2\dberr.txt CatalogDB: 11:57:59 AM 4/25/2023: Init:: Database previously shutdown dirty C:\Windows\system32\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb How can repair this? Link to comment Share on other sites More sharing options...
Administrators Marcos 5,231 Posted April 25, 2023 Administrators Share Posted April 25, 2023 22 minutes ago, Jarvick Castillo said: How can repair this? Please follow https://social.technet.microsoft.com/wiki/contents/articles/13827.windows-server-2008-event-id-257-system-catalog-database-integrity.aspx. Link to comment Share on other sites More sharing options...
EranBix 0 Posted April 26, 2023 Share Posted April 26, 2023 @ Marcos First post The servers are then relatively difficult to operate and the message appears when logging off:Please wait for "Notification text for system events". As I am reading this topic all ppl write about this problem... Link to comment Share on other sites More sharing options...
Administrators Marcos 5,231 Posted April 26, 2023 Administrators Share Posted April 26, 2023 20 minutes ago, EranBix said: First post The servers are then relatively difficult to operate and the message appears when logging off:Please wait for "Notification text for system events". Isn't it possible to manually trigger a crash and generate a complete memory dump at this point as per https://support.eset.com/en/kb380? Link to comment Share on other sites More sharing options...
devlin 5 Posted April 26, 2023 Share Posted April 26, 2023 6 hours ago, EranBix said: @ Marcos First post The servers are then relatively difficult to operate and the message appears when logging off:Please wait for "Notification text for system events". As I am reading this topic all ppl write about this problem... Yes, I think so too. We are experiencing the same problem on WS 2012 R2 and WS 2019. Both RDS. And unfortunately we are not aware how to manually trigger a crash. Link to comment Share on other sites More sharing options...
Administrators Marcos 5,231 Posted April 26, 2023 Administrators Share Posted April 26, 2023 Just now, devlin said: And unfortunately we are not aware how to manually trigger a crash. Please refer to https://support.eset.com/en/kb380 for instructions. We've heard that switching to the pre-release update channel in the advanced setup reportedly fixes the issue. However, this has not been 100% confirmed yet and the issue as well as the root cause is being investigated. We're currently waiting for memory dumps to analyze them. devlin 1 Link to comment Share on other sites More sharing options...
Jarvick Castillo 0 Posted May 2, 2023 Share Posted May 2, 2023 On 4/25/2023 at 12:36 PM, Marcos said: Please follow https://social.technet.microsoft.com/wiki/contents/articles/13827.windows-server-2008-event-id-257-system-catalog-database-integrity.aspx. Doesn´t Work This, stills occurrs few times yet. Link to comment Share on other sites More sharing options...
Administrators Marcos 5,231 Posted May 3, 2023 Administrators Share Posted May 3, 2023 4 hours ago, Jarvick Castillo said: Doesn´t Work This, stills occurrs few times yet. We'll need a complete memory dump from time when the issue occurs in order to determine the root cause. Link to comment Share on other sites More sharing options...
2spiK 0 Posted May 8, 2023 Share Posted May 8, 2023 Same here... Windows notifications services stuck on RDS session opening Windows Server 2019 affected.. We are thinking of uninstalling ESET and leaving Windows Defender until our dear editor patches the product Link to comment Share on other sites More sharing options...
Martin_L 2 Posted May 10, 2023 Share Posted May 10, 2023 Has anyone managed to resolve this? I have the same problem with one of my customers. Windows Server 2016 with RDS role, ESET Server Security 10.0.12010.0. It will run fine for a few days, maybe a week, then sessions start getting blocked with the "waiting for SENS" message. I will try to get a complete memory dump the next time it occurs. Link to comment Share on other sites More sharing options...
ESET Moderators Peter Randziak 1,158 Posted May 10, 2023 ESET Moderators Share Posted May 10, 2023 Hello @2spiK and @Martin_L, the development team needs a complete memory dump from such state to analyze the issue. Once you have it, please pack it, upload to a safe location and send the download details to me and @Marcos over a private message Peter (note for us: P_EFSW-2430) Link to comment Share on other sites More sharing options...
Andy C 0 Posted May 11, 2023 Share Posted May 11, 2023 I'm just troubleshooting this for the second time in 3 weeks. We resolved the first instance of this on our 2019 RDS server by uninstalling KB5023702. We've now got the same issue after installing KB5025229. This server has ESET Server Security 10.0.12010.0. I'm working through the issue at present. Andy Link to comment Share on other sites More sharing options...
ESET Moderators Peter Randziak 1,158 Posted May 11, 2023 ESET Moderators Share Posted May 11, 2023 Hello @Andy C, sorry to hear that you experienced the issue again. Can you please provide us with a complete memory dump from the server in such state so our development team can investigate it? Once you have it, please pack it, upload to a safe location and send the download details to me and @Marcos over a private message. Thank you, Peter Link to comment Share on other sites More sharing options...
Joel V 2 Posted May 11, 2023 Share Posted May 11, 2023 We have now experienced this issue in the last ~3 weeks on a range of different virtual servers (Hyper-V 2012 R2, 2016 and 2019), running on different hardware. There is no common thread apart from the fact we recently upgraded all our server antivirus versions to ESET Server Security 10. What happens is that the server becomes unresponsive, a lot of programs refuse to open and when you try to restart the server, it will just hang with the message "waiting for system event notification service to close". This needs *urgent* attention. Link to comment Share on other sites More sharing options...
Administrators Marcos 5,231 Posted May 11, 2023 Administrators Share Posted May 11, 2023 31 minutes ago, Joel V said: This needs *urgent* attention. We indeed treat this with high priority, however, we need a complete memory dump from you for investigation and to determine the root cause. Peter Randziak 1 Link to comment Share on other sites More sharing options...
kapela86 11 Posted May 11, 2023 Share Posted May 11, 2023 I've experienced this problem some time ago. Server 2016 with RDS role & Eset 10.0.12010.0. Users suddenly couldn't copy files to/from remote desktop and when they tried logging out it stayed stuck at waiting for System Event Notification Service to shut down. I tried restarting the server and it coudn't shut down so I had to reset it (powercycle), after that it was working ok and I didn't investigate it . And now today it happened again and after reset I did some checking and found out many entries in event viewer that explorer.exe was not responding because of ekrn.exe. After that I looked here and found this topic. I don't have any memory dumps etc (and even If I did, that VM has 90GB of ram). I can only provide you with this. Pakiet błędów 2194417022129290342, typ 5 Nazwa zdarzenia: AppHangXProcB1 Odpowiedź: Niedostępny Identyfikator pliku Cab: 0 Sygnatura problemu: P1: explorer.exe P2: 10.0.14393.5648 P3: 63b792d6 P4: d642 P5: 134217856 P6: ekrn.exe P7: 0.0.0.0 P8: P9: P10: Dołączone pliki: Te pliki mogą być dostępne tutaj: C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppHang_explorer.exe_c3235ec849cb1bb83f36349d51f02ab2c0f54ee7_2bda4280_c73c947d Symbol analizy: Ponowne sprawdzanie rozwiązania: 0 Identyfikator raportu: 8749a4a8-effa-11ed-85a1-00155d01dd07 Stan raportu: 0 Skrócony pakiet: f031ea1e2ec292664e7422a7b5163c66 Link to comment Share on other sites More sharing options...
Pierre Belec 0 Posted May 11, 2023 Share Posted May 11, 2023 I had the same problem with 4 Windows 2012R2 servers. I noticed that when I get a notification from the server that some updates are ready to install, the problem appears. After restarting the server, Windows applies the new updates and Eset too. So far the servers seem fine. If that can help. Link to comment Share on other sites More sharing options...
Recommended Posts