Jump to content

Recommended Posts

Posted

Again - i am another with this same issue.  EKRN crash causing the SENS service to hang for users.  

2012r2 rdp server, 80gb ram, intermittently happens. might be time to get rid of the ESET product altogether if we cant get some action on this.

Posted

A fifth server 2012R2 had the problem today.

When you log out the message is " Please wait for the system event notification service "

Sorry for the message in another language the system was installed in French.

 

Description
Un problème a provoqué l’arrêt de l’interaction de ce programme avec Windows.
Chemin d’accès de l’application défaillante :    C:\Windows\explorer.exe

Signature du problème
Nom d’événement du problème :    AppHangXProcB1
Nom de l’application:    explorer.exe
Version de l’application:    6.3.9600.18231
Horodatage de l’application:    56b8c9f1
Signature de blocage:    5fa0
Type de blocage:    134217856
Attente du nom de l’application:    ekrn.exe
Attente de la version de l’application:    0.0.0.0
Version du système:    6.3.9600.2.0.0.16.7
Identificateur de paramètres régionaux:    3084
Signature de blocage supplém. 1:    5fa096dae1468101fb03e91bd7f6dfcc
Signature de blocage supplém. 2:    c66b
Signature de blocage supplém. 3:    c66bc372ef269de9c7b52eae49af3b15
Signature de blocage supplém. 4:    5fa0
Signature de blocage supplém. 5:    5fa096dae1468101fb03e91bd7f6dfcc
Signature de blocage supplém. 6:    c66b
Signature de blocage supplém. 7:    c66bc372ef269de9c7b52eae49af3b15

 

  • Administrators
Posted

Do you happen to know for how long the server had been running before the issue occurred? Are you able to reproduce it relatively shortly after a restart?

Posted

The problem appeared randomly.

I had the problem on 4 different servers.

The fifth server that has the problem has been running for 10 days, it will be restarted tonight.

I am unable to reproduce the problem.

This server never has a problem is the first time.

The servers that I have restarted have not yet had any problems.

The problem only happened once on each server.

  • Administrators
Posted

Is there anybody who has experienced the issue more times on a server?  Or it always happened just once on a particular server and never again after a reboot?

The best would be if you have the system already configured for a manual crash and to generate complete memory dumps so that you could generate one should the issue occur.

Posted

Hi Marcos,

We've had it occur twice on a 2022 RDP server. Both occurred after 5-7 days uptime

We've downgraded to v9 for the time being as the server is actively used

 

Posted
9 hours ago, Marcos said:

Is there anybody who has experienced the issue more times on a server?  Or it always happened just once on a particular server and never again after a reboot?

The best would be if you have the system already configured for a manual crash and to generate complete memory dumps so that you could generate one should the issue occur.

I have had it happening four times on the same server, uptime between the failures was 4-20 days.

I have (hopefully) managed to set it up for a full memory dump when the problem occurs again. 

  • Administrators
Posted

Ok, if anybody can get a full dump from the frozen state, please let us know and supply it to us asap. We assure you that we treat the issue with highest possible priority, however, it's unfortunate that it can't be reproduced at any time or on our end by providing step-by-step instructions like it's in case of most other issues. As soon as we manage to get a dump, we'll analyze it and prepare a fix if the root cause is confirmed to be in ESET. On mission critical servers you can downgrade to Endpoint Security v9 that some of you have confirmed the issue hasn't re-emerged afterwards.

Posted

For the first time I have a 2012R2 server which has the problem a second time. After 14 days of operation.

  • Administrators
Posted

Allegedly disabling RDP protection resolves the issue according to one of the users. Will keep you posted.

image.png

 

Posted

The problem appeared a second time on another system.

Before the second problem, Windows and Eset were up to date.

Eset Version 10.0.12010.0

After restarting the server, Eset did a very long update.

See screenshot.

I find that when a Windows update is available the problem appears.

Is it just a coincidence?

Eset3.JPG

Posted

Hello all,
I have also confirm this issue on four RDS terminal servers (Windows Server 2016, ESET Server Security 10.0.12010.0). Issue occured each 14 days regulary.

I will need downgrade the ESET to 9.0.12017.0 version.

Posted

@Pierre Belec - Does the issue still persists on ESET Server Security 10.0.12010.0 with RDP Intrusion Detection feature disabled?

Posted

@TomasB22 Yes, issue persist. This fix is not working for us.

@Marcos Thanks for the tip Marcos, but unfortunatelly it's not working for us. We had to roll back to v9 and can't experiment anymore. People are really anoyed by this issue. What about memory dump I have provided? Is it ok?

Posted
Quote

 

We have the same issue on couple of RDP/Terminal servers.

We will be testing suggested "RDP switch" and downgrade from 10-9 with different combinations to see results.

Posted

I can confirm that turning off RDP protection did not resolve the problem.

On the bright side I was able to pull a complete memory dump (30GB) from an affected server, fingers crossed this one contains the data needed for a solution.

Posted

For now I restart our RDP servers every sunday when no one is working. No problems so far.

  • Administrators
Posted

We have pinpointed the issue. It will be addressed in a hotfix that is being prepared and should be available soon. Thank you for co-operation on this matter.

Posted

Same thing here today, few hours ago had to restart a server. Windows server 2012 R2 updated with latest updates, together with ESET Server Security to v10.0.12010.0, on 28.05.2023. For now solution is to downgrade to v9. Or restart every Sunday when no one is working, as kapela86 said.

Posted

Again today, same problem...(did not downgraded to v9; I guess i really have to).

Posted
On 6/6/2023 at 4:01 PM, Marcos said:

The issue will be fixed in the ESSW v10 hotfix which is being prepared and will be available soon.

When will this update be available? This problem is driving me nuts since months now!

  • Administrators
Posted
1 hour ago, HI-IT said:

When will this update be available? This problem is driving me nuts since months now!

Soon. The hotfix is currently undergoing pre-release QA tests.

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...