ivessy85 0 Posted May 13, 2023 Posted May 13, 2023 Again - i am another with this same issue. EKRN crash causing the SENS service to hang for users. 2012r2 rdp server, 80gb ram, intermittently happens. might be time to get rid of the ESET product altogether if we cant get some action on this.
Pierre Belec 0 Posted May 15, 2023 Posted May 15, 2023 A fifth server 2012R2 had the problem today. When you log out the message is " Please wait for the system event notification service " Sorry for the message in another language the system was installed in French. Description Un problème a provoqué l’arrêt de l’interaction de ce programme avec Windows. Chemin d’accès de l’application défaillante : C:\Windows\explorer.exe Signature du problème Nom d’événement du problème : AppHangXProcB1 Nom de l’application: explorer.exe Version de l’application: 6.3.9600.18231 Horodatage de l’application: 56b8c9f1 Signature de blocage: 5fa0 Type de blocage: 134217856 Attente du nom de l’application: ekrn.exe Attente de la version de l’application: 0.0.0.0 Version du système: 6.3.9600.2.0.0.16.7 Identificateur de paramètres régionaux: 3084 Signature de blocage supplém. 1: 5fa096dae1468101fb03e91bd7f6dfcc Signature de blocage supplém. 2: c66b Signature de blocage supplém. 3: c66bc372ef269de9c7b52eae49af3b15 Signature de blocage supplém. 4: 5fa0 Signature de blocage supplém. 5: 5fa096dae1468101fb03e91bd7f6dfcc Signature de blocage supplém. 6: c66b Signature de blocage supplém. 7: c66bc372ef269de9c7b52eae49af3b15
Administrators Marcos 5,741 Posted May 15, 2023 Administrators Posted May 15, 2023 Do you happen to know for how long the server had been running before the issue occurred? Are you able to reproduce it relatively shortly after a restart?
Pierre Belec 0 Posted May 15, 2023 Posted May 15, 2023 The problem appeared randomly. I had the problem on 4 different servers. The fifth server that has the problem has been running for 10 days, it will be restarted tonight. I am unable to reproduce the problem. This server never has a problem is the first time. The servers that I have restarted have not yet had any problems. The problem only happened once on each server.
Administrators Marcos 5,741 Posted May 15, 2023 Administrators Posted May 15, 2023 Is there anybody who has experienced the issue more times on a server? Or it always happened just once on a particular server and never again after a reboot? The best would be if you have the system already configured for a manual crash and to generate complete memory dumps so that you could generate one should the issue occur.
tomosull 0 Posted May 15, 2023 Posted May 15, 2023 Hi Marcos, We've had it occur twice on a 2022 RDP server. Both occurred after 5-7 days uptime We've downgraded to v9 for the time being as the server is actively used
Martin_L 2 Posted May 16, 2023 Posted May 16, 2023 9 hours ago, Marcos said: Is there anybody who has experienced the issue more times on a server? Or it always happened just once on a particular server and never again after a reboot? The best would be if you have the system already configured for a manual crash and to generate complete memory dumps so that you could generate one should the issue occur. I have had it happening four times on the same server, uptime between the failures was 4-20 days. I have (hopefully) managed to set it up for a full memory dump when the problem occurs again.
Administrators Marcos 5,741 Posted May 16, 2023 Administrators Posted May 16, 2023 Ok, if anybody can get a full dump from the frozen state, please let us know and supply it to us asap. We assure you that we treat the issue with highest possible priority, however, it's unfortunate that it can't be reproduced at any time or on our end by providing step-by-step instructions like it's in case of most other issues. As soon as we manage to get a dump, we'll analyze it and prepare a fix if the root cause is confirmed to be in ESET. On mission critical servers you can downgrade to Endpoint Security v9 that some of you have confirmed the issue hasn't re-emerged afterwards. Peter Randziak 1
devlin 5 Posted May 17, 2023 Posted May 17, 2023 We were finally able to get memory dump. I hope it's complete. I'm sending you link via PM. tomosull, Martin_L, Valerius and 1 other 4
Pierre Belec 0 Posted May 19, 2023 Posted May 19, 2023 For the first time I have a 2012R2 server which has the problem a second time. After 14 days of operation.
Administrators Marcos 5,741 Posted May 23, 2023 Administrators Posted May 23, 2023 Allegedly disabling RDP protection resolves the issue according to one of the users. Will keep you posted. Martin_L 1
Pierre Belec 0 Posted May 23, 2023 Posted May 23, 2023 The problem appeared a second time on another system. Before the second problem, Windows and Eset were up to date. Eset Version 10.0.12010.0 After restarting the server, Eset did a very long update. See screenshot. I find that when a Windows update is available the problem appears. Is it just a coincidence?
TomasB22 0 Posted May 25, 2023 Posted May 25, 2023 Hello all, I have also confirm this issue on four RDS terminal servers (Windows Server 2016, ESET Server Security 10.0.12010.0). Issue occured each 14 days regulary. I will need downgrade the ESET to 9.0.12017.0 version.
Pierre Belec 0 Posted May 25, 2023 Posted May 25, 2023 Hello Marcos, I disabled the RDP protocol and had the same problem.
TomasB22 0 Posted May 26, 2023 Posted May 26, 2023 @Pierre Belec - Does the issue still persists on ESET Server Security 10.0.12010.0 with RDP Intrusion Detection feature disabled?
devlin 5 Posted May 26, 2023 Posted May 26, 2023 @TomasB22 Yes, issue persist. This fix is not working for us. @Marcos Thanks for the tip Marcos, but unfortunatelly it's not working for us. We had to roll back to v9 and can't experiment anymore. People are really anoyed by this issue. What about memory dump I have provided? Is it ok?
MaciejPL 0 Posted May 27, 2023 Posted May 27, 2023 Quote We have the same issue on couple of RDP/Terminal servers. We will be testing suggested "RDP switch" and downgrade from 10-9 with different combinations to see results.
Martin_L 2 Posted May 31, 2023 Posted May 31, 2023 I can confirm that turning off RDP protection did not resolve the problem. On the bright side I was able to pull a complete memory dump (30GB) from an affected server, fingers crossed this one contains the data needed for a solution. Valerius 1
kapela86 11 Posted May 31, 2023 Posted May 31, 2023 For now I restart our RDP servers every sunday when no one is working. No problems so far. Ajvan 1
Administrators Marcos 5,741 Posted May 31, 2023 Administrators Posted May 31, 2023 We have pinpointed the issue. It will be addressed in a hotfix that is being prepared and should be available soon. Thank you for co-operation on this matter. Martin_L, devlin and Valerius 3
Ajvan 2 Posted June 2, 2023 Posted June 2, 2023 Same thing here today, few hours ago had to restart a server. Windows server 2012 R2 updated with latest updates, together with ESET Server Security to v10.0.12010.0, on 28.05.2023. For now solution is to downgrade to v9. Or restart every Sunday when no one is working, as kapela86 said.
Ajvan 2 Posted June 6, 2023 Posted June 6, 2023 Again today, same problem...(did not downgraded to v9; I guess i really have to).
Administrators Marcos 5,741 Posted June 6, 2023 Administrators Posted June 6, 2023 The issue will be fixed in the ESSW v10 hotfix which is being prepared and will be available soon. Valerius, Aryeh Goretsky, TomasB22 and 2 others 5
HI-IT 0 Posted June 14, 2023 Posted June 14, 2023 On 6/6/2023 at 4:01 PM, Marcos said: The issue will be fixed in the ESSW v10 hotfix which is being prepared and will be available soon. When will this update be available? This problem is driving me nuts since months now!
Administrators Marcos 5,741 Posted June 14, 2023 Administrators Posted June 14, 2023 1 hour ago, HI-IT said: When will this update be available? This problem is driving me nuts since months now! Soon. The hotfix is currently undergoing pre-release QA tests.
Recommended Posts