ivessy85 0 Posted May 13, 2023 Share Posted May 13, 2023 Again - i am another with this same issue. EKRN crash causing the SENS service to hang for users. 2012r2 rdp server, 80gb ram, intermittently happens. might be time to get rid of the ESET product altogether if we cant get some action on this. Link to comment Share on other sites More sharing options...
Pierre Belec 0 Posted May 15, 2023 Share Posted May 15, 2023 A fifth server 2012R2 had the problem today. When you log out the message is " Please wait for the system event notification service " Sorry for the message in another language the system was installed in French. Description Un problème a provoqué l’arrêt de l’interaction de ce programme avec Windows. Chemin d’accès de l’application défaillante : C:\Windows\explorer.exe Signature du problème Nom d’événement du problème : AppHangXProcB1 Nom de l’application: explorer.exe Version de l’application: 6.3.9600.18231 Horodatage de l’application: 56b8c9f1 Signature de blocage: 5fa0 Type de blocage: 134217856 Attente du nom de l’application: ekrn.exe Attente de la version de l’application: 0.0.0.0 Version du système: 6.3.9600.2.0.0.16.7 Identificateur de paramètres régionaux: 3084 Signature de blocage supplém. 1: 5fa096dae1468101fb03e91bd7f6dfcc Signature de blocage supplém. 2: c66b Signature de blocage supplém. 3: c66bc372ef269de9c7b52eae49af3b15 Signature de blocage supplém. 4: 5fa0 Signature de blocage supplém. 5: 5fa096dae1468101fb03e91bd7f6dfcc Signature de blocage supplém. 6: c66b Signature de blocage supplém. 7: c66bc372ef269de9c7b52eae49af3b15 Link to comment Share on other sites More sharing options...
Administrators Marcos 5,074 Posted May 15, 2023 Administrators Share Posted May 15, 2023 Do you happen to know for how long the server had been running before the issue occurred? Are you able to reproduce it relatively shortly after a restart? Link to comment Share on other sites More sharing options...
Pierre Belec 0 Posted May 15, 2023 Share Posted May 15, 2023 The problem appeared randomly. I had the problem on 4 different servers. The fifth server that has the problem has been running for 10 days, it will be restarted tonight. I am unable to reproduce the problem. This server never has a problem is the first time. The servers that I have restarted have not yet had any problems. The problem only happened once on each server. Link to comment Share on other sites More sharing options...
Administrators Marcos 5,074 Posted May 15, 2023 Administrators Share Posted May 15, 2023 Is there anybody who has experienced the issue more times on a server? Or it always happened just once on a particular server and never again after a reboot? The best would be if you have the system already configured for a manual crash and to generate complete memory dumps so that you could generate one should the issue occur. Link to comment Share on other sites More sharing options...
tomosull 0 Posted May 15, 2023 Share Posted May 15, 2023 Hi Marcos, We've had it occur twice on a 2022 RDP server. Both occurred after 5-7 days uptime We've downgraded to v9 for the time being as the server is actively used Link to comment Share on other sites More sharing options...
Martin_L 2 Posted May 16, 2023 Share Posted May 16, 2023 9 hours ago, Marcos said: Is there anybody who has experienced the issue more times on a server? Or it always happened just once on a particular server and never again after a reboot? The best would be if you have the system already configured for a manual crash and to generate complete memory dumps so that you could generate one should the issue occur. I have had it happening four times on the same server, uptime between the failures was 4-20 days. I have (hopefully) managed to set it up for a full memory dump when the problem occurs again. Link to comment Share on other sites More sharing options...
Administrators Marcos 5,074 Posted May 16, 2023 Administrators Share Posted May 16, 2023 Ok, if anybody can get a full dump from the frozen state, please let us know and supply it to us asap. We assure you that we treat the issue with highest possible priority, however, it's unfortunate that it can't be reproduced at any time or on our end by providing step-by-step instructions like it's in case of most other issues. As soon as we manage to get a dump, we'll analyze it and prepare a fix if the root cause is confirmed to be in ESET. On mission critical servers you can downgrade to Endpoint Security v9 that some of you have confirmed the issue hasn't re-emerged afterwards. Peter Randziak 1 Link to comment Share on other sites More sharing options...
devlin 5 Posted May 17, 2023 Share Posted May 17, 2023 We were finally able to get memory dump. I hope it's complete. I'm sending you link via PM. Peter Randziak, tomosull, Martin_L and 1 other 4 Link to comment Share on other sites More sharing options...
Pierre Belec 0 Posted May 19, 2023 Share Posted May 19, 2023 For the first time I have a 2012R2 server which has the problem a second time. After 14 days of operation. Link to comment Share on other sites More sharing options...
Administrators Marcos 5,074 Posted May 23, 2023 Administrators Share Posted May 23, 2023 Allegedly disabling RDP protection resolves the issue according to one of the users. Will keep you posted. Martin_L 1 Link to comment Share on other sites More sharing options...
Pierre Belec 0 Posted May 23, 2023 Share Posted May 23, 2023 The problem appeared a second time on another system. Before the second problem, Windows and Eset were up to date. Eset Version 10.0.12010.0 After restarting the server, Eset did a very long update. See screenshot. I find that when a Windows update is available the problem appears. Is it just a coincidence? Link to comment Share on other sites More sharing options...
TomasB22 0 Posted May 25, 2023 Share Posted May 25, 2023 Hello all, I have also confirm this issue on four RDS terminal servers (Windows Server 2016, ESET Server Security 10.0.12010.0). Issue occured each 14 days regulary. I will need downgrade the ESET to 9.0.12017.0 version. Link to comment Share on other sites More sharing options...
Pierre Belec 0 Posted May 25, 2023 Share Posted May 25, 2023 Hello Marcos, I disabled the RDP protocol and had the same problem. Link to comment Share on other sites More sharing options...
TomasB22 0 Posted May 26, 2023 Share Posted May 26, 2023 @Pierre Belec - Does the issue still persists on ESET Server Security 10.0.12010.0 with RDP Intrusion Detection feature disabled? Link to comment Share on other sites More sharing options...
devlin 5 Posted May 26, 2023 Share Posted May 26, 2023 @TomasB22 Yes, issue persist. This fix is not working for us. @Marcos Thanks for the tip Marcos, but unfortunatelly it's not working for us. We had to roll back to v9 and can't experiment anymore. People are really anoyed by this issue. What about memory dump I have provided? Is it ok? Link to comment Share on other sites More sharing options...
MaciejPL 0 Posted May 27, 2023 Share Posted May 27, 2023 Quote We have the same issue on couple of RDP/Terminal servers. We will be testing suggested "RDP switch" and downgrade from 10-9 with different combinations to see results. Link to comment Share on other sites More sharing options...
Martin_L 2 Posted May 31, 2023 Share Posted May 31, 2023 I can confirm that turning off RDP protection did not resolve the problem. On the bright side I was able to pull a complete memory dump (30GB) from an affected server, fingers crossed this one contains the data needed for a solution. Valerius 1 Link to comment Share on other sites More sharing options...
kapela86 10 Posted May 31, 2023 Share Posted May 31, 2023 For now I restart our RDP servers every sunday when no one is working. No problems so far. Ajvan 1 Link to comment Share on other sites More sharing options...
Administrators Marcos 5,074 Posted May 31, 2023 Administrators Share Posted May 31, 2023 We have pinpointed the issue. It will be addressed in a hotfix that is being prepared and should be available soon. Thank you for co-operation on this matter. Martin_L, devlin and Valerius 3 Link to comment Share on other sites More sharing options...
Ajvan 2 Posted June 2, 2023 Share Posted June 2, 2023 Same thing here today, few hours ago had to restart a server. Windows server 2012 R2 updated with latest updates, together with ESET Server Security to v10.0.12010.0, on 28.05.2023. For now solution is to downgrade to v9. Or restart every Sunday when no one is working, as kapela86 said. Link to comment Share on other sites More sharing options...
Ajvan 2 Posted June 6, 2023 Share Posted June 6, 2023 Again today, same problem...(did not downgraded to v9; I guess i really have to). Link to comment Share on other sites More sharing options...
Administrators Marcos 5,074 Posted June 6, 2023 Administrators Share Posted June 6, 2023 The issue will be fixed in the ESSW v10 hotfix which is being prepared and will be available soon. TomasB22, tomosull, Valerius and 2 others 5 Link to comment Share on other sites More sharing options...
HI-IT 0 Posted June 14, 2023 Share Posted June 14, 2023 On 6/6/2023 at 4:01 PM, Marcos said: The issue will be fixed in the ESSW v10 hotfix which is being prepared and will be available soon. When will this update be available? This problem is driving me nuts since months now! Link to comment Share on other sites More sharing options...
Administrators Marcos 5,074 Posted June 14, 2023 Administrators Share Posted June 14, 2023 1 hour ago, HI-IT said: When will this update be available? This problem is driving me nuts since months now! Soon. The hotfix is currently undergoing pre-release QA tests. Link to comment Share on other sites More sharing options...
Recommended Posts