CSA reporting
I get a plain Crystal Report screen whenever I attempt to complete an Active X report. I need help with this bad.
Check under %windir%\Downloaded Program Files for the Crystal Report Viewer Control. If it's there, something is preventing the report from rendering. If it's not, something is preventing the ActiveX control from either downloading or installing when you try to view the reports. Since the MC has the same problem I might bet on number one, but who knows...?
Similar Messages
-
CSA Report Viewing ActiveX problem IE7
When I am trying to run the reports in CSA they work fine, in HTML format. However when I am trying to view them in activeX, it comes back on IE7, telling me it cannot access the resource and that I need to install IE4 and DCOM for windows 95. I am sure that I am simply over looking something. Suggestions?
You sir.. are fantastic!!! RESOLVED - Solution :
To Resolve:
1. Open up Internet Explorer 7
2. From the Tools menu, select Internet Options
3. From the new popup window, select the Security tab
4. Ensure that you highlight Internet
5. Click on the button named Custom level
*The Security Settings menu will now come into view*
6. Scroll down the settings until you reach "ActiveX controls and plug-ins"
7. Ensure the settings are as below -
Allow previously unused ActiveX controls to run without prompt
Enable
Allow Scriptlets
Disable
Automatic prompting for ActiveX controls
Enable
Binary and script behaviours
Enable
Display video and animation on a web page that does not use external media player
Disable
Download signed ActiveX controls
Prompt
Download unsigned ActiveX controls
Disable
Initialize and script ActiveX controls not marked as safe for scripting
Disable
Run ActiveX controls and plug-ins
Enable
Script ActiveX controls marked as safe from scripting*
Enable
Please ensure that you click OK, once finished ? to save -
Mail a Central System Administration report
Hi,
We are started with the configuration of the CSA (Central System Administration) on Solution Manager.
Each check session is available on a HTML and/or MSWord report.
Now I want to mail these report to a mailbox on a regular basis.
I wonder if that is possible.
I cannot find any information about that.
The SAPConnect (SCOT) is well configured.
Hope somebody can help me out
Thanks
PaulDid you ever get this working? Also have you found a way to combine CSA reports from multiple systems into one report perhaps?
-
Rootkit detected CSA 5.0
I'm trying to determine if the logs I'm getting in CSA are an accurate report of a rootkit, or could they be false positive?
CSA reports two of my hosts both XP Pro are in Untrusted Rootkit mode. error messages look similar, but using 3rd party tools show no sign of a rootkit. How can I determine if this is a false positive?
Description Set Rootkit detected as Untrusted, All hashes and codes modify kernel functionality
Module System Hardening Module [W, V5.0 r176]
? Event details:
Event Text Kernel functionality has been modified by the module <unknown@0xe3370400>. The module '<unknown@0xe3370400>' is used by entries in the System syscall table. The specified action was taken to set detected rootkit as Untrusted.
Event Time 3/2/2007 5:38:03 PM
Code MODULE_MODIFY_TAG
PInt 46
PInt2 12
PString detected rootkit as Untrusted
PString2 <unknown@0xe3370400>
PInt3 6
args(4) 8b542420528b542420a14cc914e3528b5424208b08528b542420528b542420528b542420528b542420528b542420525 0ff1183c424c220009090909090909090
args(5) <unknown>
time 82.2 (seconds since boot)
type EVTU
EvSrcComp 9
EvDst 1
EvDstComp 7
EvCode MODULE_USED_BY_SYS_TABLE
EvPInt 1
EvPString <unknown@0xe3370400>
EvPInt2 31
EvPString2 8b542420 528b5424 20a14cc9 14e3528b
5424208b 08528b54 2420528b 54242052
8b542420 528b5424 20528b54 24205250
ff1183c4 24c22000 90909090 90909090
EvPInt3 -482933760
EvPString3 ConnectPort
FlattenedForm (t-1172875082 n-678166400 z--18000 sm-114 sc-13 dm-1 dc-7 cd-762 hp-2 p*(i-46 i-12 a-detected%20rootkit%20as%20Untrusted a-<unknown@0xe3370400> i-6 a- a-8b542420528b542420a14cc914e3528b5424208b08528b542420528b542420528b542420528b542420528b5424205 250ff1183c424c220009090909090909090 a-<unknown> r*(type-11 time-822 rev*(sc-9 dm-1 dc-7 cd-175 p*(i-1 a-<unknown@0xe3370400> i-31 d-lsfjGi1IurciHYuYumUulsfjGSicsTivKaIulsfjGi1IurcisTivKaIulsfjGifu*hXGetIWGaaKqcjKqcjKqc i--482933760 a-ConnectPort ) ) ) ) )5.1 probably won't make a difference. We have several ugly apps that give us similar messages.
AutoCAD and Powerbuilder 10 are the two ugliest I've seen with regards to unknown processes. I'm not sure how I'll deal with this one when we move to 5.X. I may need to create a DAC that ignores rootkits discovered after these apps fire off.
A pain...
Tom -
CSA 6.0.1 Customizing Reports on Hosts Who Have Disabled Agents
We set up a rule which asks the user to supply a reason when they disable the CSA Agent.
Is there a way to customize a report to include the reason in a report?
We want to generate a report weekly which would include the end user name and the reason they disabled the agent.
Thanks.Thanks for that, I'm still looking for confirmation for the Unix side...
-
Automated reporting in CSA 5.2???
Hello,
I'm wondering if anyone has any knowledge on whether automated reporting can be setup on CSA 5.2, or if anyone has developed a process that would generate automated reports from the CSA events and alerts and have them e-mailed to say, Network Administrators?
Thanks in advance,
CharlesYou can configure event sets and use alerts to email them. There are several canned event sets you can use or create your own.
You can configure alerts to use:
Email
SNMP
Log
Custom
Named Pipe
Tom -
CSA MC reporting granularity bugged?
If I create an event set that for example filters to only file access control denied, only in the music download prevention policy and I choose view I see just that, all denied file access control events from the music download prevention policy.
I name this event set "Denied Music Downloads"
sweet......but.....
If I then try to run a report based on that event set the report will return all file access control denied events regardless of which poilicy the event came from. Is this a feature? Bug? Version specific? Can someone test this on their setup for me?
It seems that the report will only filter on the event code which in my case is 77. It never gets to the "only in the music download prevention policy" portion of the set.result of the Report will be group or sub group wise.
-
The report l runs very night and gets ended with error
Dear all,
I am facing a problem in solution manger. There is an report (Program/Command RDSMOPSOL_MONIREFRESH ) will runs very night and get ended with error and there is Run-time error "MESSAGE_TYPE_X".
Please suggest how to solve the problem.
Is this report is necessary for the system because it is not mention in the sap stand jobs.
SM37 log
Job started
Step 001 started (program RDSMOPSOL_MONIREFRESH, variant &0000000000875, user ID BASIS)
Opening and closing session started. Session SM2000000000065
Opening and closing the session was successful. Session: SM2000000000065
Opening and closing session started. Session SM2000000000005
ABAP/4 processor: MESSAGE_TYPE_X
Job cancelled
SM:CSA SESSION REFRESH
No. Program/Command Prog. type Spool list Parameter User Lang.
1 RDSMOPSOL_MONIREFRESH ABAP &0000000000876 BASIS EN
Sm21 log
00:00:50 DIA 00 000 SAPSYS EEA OPERATION MODES: Switch to operation mode Normal triggered
00:30:57 BTC 08 200 BASIS R68 Perform rollback
00:30:57 BTC 08 200 BASIS AB0 Run-time error "MESSAGE_TYPE_X" occurred
00:30:57 BTC 08 200 BASIS AB1 > Short dump "081112 003057 sapsm BASIS " generated
00:30:57 BTC 08 200 BASIS D01 Transaction Canceled 00 671 ( MESSAGE_TYPE_X 20081112003057sapsm BASIS 2001 )
00:30:57 BTC 08 200 BASIS R68 Perform rollback
00:30:57 BTC 08 200 BASIS AB0 Run-time error "MESSAGE_TYPE_X" occurred
Details
Recording at local and central time........................ 12.11.2008 00:30:57
Task................ 05312 . 08 B8 BTC background processor No. 08
User................ BASIS
Client.............. 200
Terminal............
Session............. 1
Transaction code....
Program name........
Problem class....... T Transaction Problem
Development class... SABP
Further details for this message type
Module name......... abdynpro
Line................ 1133
Error text.......... ab_jmess
Documentation for system log message AB 0 :
The specified runtime error has occurred in the system.
Parameter
a.. MESSAGE_TYPE_X
Technical details
File................ 000048
Position............ 0000253620
Entry type.......... l ( Error (Module, Row) )
Message ID.......... AB 0
Variable parts...... ab_jmess abdynpro1133
Time Ty. Nr Cl. User Tcod MNo Text Date : 12.11.08
00:30:57 BTC 08 200 BASIS AB1 > Short dump "081112 003057 sapsm BASIS " generated
etails
ecording at local and central time........................ 12.11.2008 00:30:57
ask................ 05312 . 08 B8 BTC background processor No. 08
ser................ BASIS
lient.............. 200
erminal............
ession............. 1
ransaction code....
rogram name........
roblem class....... K SAP Web AS Problem
evelopment class... SABP
BAP Mini dump
ate................ 20081112
ime................ 003057
ost................ sapsm
ser................ BASIS
ocumentation for system log message AB 1 :
A short dump was generated for the specified program termination.
You can analyze this short dump in the system log evaluation by
selecting this line or evaluating Table SNAP (Transaction ST22).
echnical details
ile................ 000048
osition............ 0000253800
ntry type.......... s ( ABAP Runtime Error )
essage ID.......... AB 1
ariable parts...... 081112003057sapsm BASIS
Time Ty. Nr Cl. User Tcod MNo Text Date : 12.11.08
00:30:57 BTC 08 200 BASIS D01 Transaction Canceled 00 671 ( MESSAGE_TYPE_X 20081112003057sapsm BASIS 2001 )
Details
Recording at local and central time........................ 12.11.2008 00:30:57
Task................ 05312 . 08 B8 BTC background processor No. 08
User................ BASIS
Client.............. 200
Terminal............
Session............. 1
Transaction code....
Program name........
Problem class....... K SAP Web AS Problem
Development class... SDYN
Module name.........
Location............
T100................ 00 671
Parameters..........
Documentation for system log message D0 1 :
The transaction has been terminated. This may be caused by a
termination message from the application (MESSAGE Axxx) or by an
error detected by the SAP System due to which it makes no sense to
proceed with the transaction. The actual reason for the termination
is indicated by the T100 message and the parameters.
Additional documentation for message 00 671
ABAP/4 processor: &
No documentation exists for message 00671
Parameter
a.. MESSAGE_TYPE_X
00:30:57 BTC 08 200 BASIS R68 Perform rollback
Details
Recording at local and central time........................ 12.11.2008 00:30:57
Task................ 05312 . 08 B8 BTC background processor No. 08
User................ BASIS
Client.............. 200
Terminal............
Session............. 1
Transaction code....
Program name........
Problem class....... W Warning
Development class... STSK
Further details for this message type
Module name......... thxxhead
Line................ 1240
Error text..........
Caller.............. ThIRoll
Reason/called....... roll ba
Documentation for system log message R6 8 :
An error has causes an SAP rollback. All database updates are reset.
Technical details
File................ 000048
Position............ 0000254520
Entry type.......... m ( Error (Function,Module,Row) )
Message ID.......... R6 8
Variable parts...... ThIRollroll bathxxhead1240
Regards,
ShivaHi karteek,
I have check there is Switch of operation mode but when I have checked the t-code sm63 there is no new mode are in normal mode.
There is one thing I want to ask dose this report (Program/Command RDSMOPSOL_MONIREFRESH ) run in your system or any one server because I have think there is some problem in job shued
and is also not mention in the sap stand jobs.
there is an error in sm21 in job.
BASIS SM36 EFK BP_CHECK_REPORT_VALUES: Invalid program values found. Reason:
BASIS SM36 EFC > Program RDSMOPSOL_MONIREFRESH has no variants, but a variant was specified
Is this SM37 log
Job started
Step 001 started (program RDSMOPSOL_MONIREFRESH, variant &0000000000875, user ID BASIS)
Opening and closing session started. Session SM2000000000065
Opening and closing the session was successful. Session: SM2000000000065
Opening and closing session started. Session SM2000000000005
ABAP/4 processor: MESSAGE_TYPE_X
Job cancelled
Sm21 log
SAPSYS EEA OPERATION MODES: Switch to operation mode Normal triggered
BASIS R68 Perform rollback
BASIS AB0 Run-time error "MESSAGE_TYPE_X" occurred
BASIS AB1 > Short dump "081111 003056 sapsm BASIS " generated
BASIS D01 Transaction Canceled 00 671 ( MESSAGE_TYPE_X 20081111003056sapsm BASIS 2001 )
BASIS R68 Perform rollback
BASIS R49 Communication error, CPIC return code 017, SAP return code 223
BASIS R64 > CPI-C function: CMINIT(SAP)
*BASIS SM36 EFK BP_CHECK_REPORT_VALUES: Invalid program values found. Reason:*
*BASIS SM36 EFC > Program RDSMOPSOL_MONIREFRESH has no variants, but a variant was*
specified
BASIS R68 Perform rollback
BASIS AB0 Run-time error "MESSAGE_TYPE_X" occurred
BASIS AB1 > Short dump "081111 220948 sapsm BASIS " generated
BASIS D01 Transaction Canceled 00 671 ( MESSAGE_TYPE_X 20081111220948sapsm BASIS 2001 )
Details Page 2 Line 6 System Log: Local Analysis of sapsm 1
Time Ty. Nr Cl. User Tcod MNo Text
00:00:51 DIA 00 000 SAPSYS EEA OPERATION MODES: Switch to operation mode Normal triggered
Details
Recording at local and central time........................ 13.11.2008 00:00:51
Task................ 04100 . 00 D0 Dialog work process No. 00
User................ SAPSYS
Client.............. 000
Terminal............
Session............. 1
Transaction code....
Program name........
Problem class....... S Operation Trace
Development class... SBTC
Sm63
Start/end time Name of the active operation mode
00.00 - 01.00 Normal
01.00 - 02.00 Normal
02.00 - 03.00 Normal
03.00 - 04.00 Normal
04.00 - 05.00 Normal
05.00 - 06.00 Normal
06.00 - 07.00 Normal
07.00 - 08.00 Normal
08.00 - 09.00 Normal
09.00 - 10.00 Normal
10.00 - 11.00 Normal
11.00 - 12.00 Normal
12.00 - 13.00 Normal
13.00 - 14.00 Normal
14.00 - 15.00 Normal
15.00 - 16.00 Normal
16.00 - 17.00 Normal
17.00 - 18.00 Normal
18.00 - 19.00 Normal
19.00 - 20.00 Normal
20.00 - 21.00 Normal
21.00 - 22.00 Normal
22.00 - 23.00 Normal
23.00 - 00.00 Normal
Regards, -
EtreCheck version: 2.1.8 (121)
Report generated February 17, 2015 at 10:41:52 PM CST
Download EtreCheck from http://etresoft.com/etrecheck
Click the [Click for support] links for help with non-Apple products.
Click the [Click for details] links for more information about that line.
Hardware Information: ℹ️
MacBook Pro (13-inch, Early 2011) (Technical Specifications)
MacBook Pro - model: MacBookPro8,1
1 2.3 GHz Intel Core i5 CPU: 2-core
4 GB RAM Upgradeable
BANK 0/DIMM0
2 GB DDR3 1333 MHz ok
BANK 1/DIMM0
2 GB DDR3 1333 MHz ok
Bluetooth: Old - Handoff/Airdrop2 not supported
Wireless: en1: 802.11 a/b/g/n
Battery Health: Normal - Cycle count 400
Video Information: ℹ️
Intel HD Graphics 3000 - VRAM: 384 MB
Color LCD 1280 x 800
System Software: ℹ️
OS X 10.10.2 (14C109) - Time since boot: 2 days 4:31:49
Disk Information: ℹ️
ST9320325ASG disk0 : (320.07 GB)
EFI (disk0s1) <not mounted> : 210 MB
Recovery HD (disk0s3) <not mounted> [Recovery]: 650 MB
Macintosh HD (disk1) / : 318.84 GB (176.55 GB free)
Core Storage: disk0s2 319.21 GB Online
OPTIARC DVD RW AD-5970H
USB Information: ℹ️
Apple Computer, Inc. IR Receiver
Apple Inc. FaceTime HD Camera (Built-in)
Apple Inc. Apple Internal Keyboard / Trackpad
Apple Inc. BRCM2070 Hub
Apple Inc. Bluetooth USB Host Controller
Thunderbolt Information: ℹ️
Apple Inc. thunderbolt_bus
Configuration files: ℹ️
/etc/hosts - Count: 1
Gatekeeper: ℹ️
Mac App Store and identified developers
Launch Daemons: ℹ️
[loaded] com.adobe.fpsaud.plist [Click for support]
[running] com.bradfordnetworks.agent.plist [Click for support]
[loaded] com.ea.origin.ESHelper.plist [Click for support]
[loaded] com.microsoft.office.licensing.helper.plist [Click for support]
User Launch Agents: ℹ️
[loaded] com.adobe.ARM.[...].plist [Click for support]
[loaded] com.google.keystone.agent.plist [Click for support]
[running] com.zeobit.MacKeeper.Helper.plist [Click for support]
User Login Items: ℹ️
Dropbox Application (/Applications/Dropbox.app)
Garmin ANT Agent Application (/Applications/Garmin ANT Agent.app)
CSA Application (/Library/Application Support/Bradford Networks/Persistent Agent/CSA.app)
Internet Plug-ins: ℹ️
Default Browser: Version: 600 - SDK 10.10
Flip4Mac WMV Plugin: Version: 3.0.0.126 - SDK 10.8 [Click for support]
net.juniper.DSSafariExtensions: Version: Unknown [Click for support]
AdobePDFViewerNPAPI: Version: 10.1.13 [Click for support]
FlashPlayer-10.6: Version: 16.0.0.305 - SDK 10.6 [Click for support]
Silverlight: Version: 5.1.20913.0 - SDK 10.6 [Click for support]
Flash Player: Version: 16.0.0.305 - SDK 10.6 [Click for support]
QuickTime Plugin: Version: 7.7.3
iPhotoPhotocast: Version: 7.0 - SDK 10.8
SharePointBrowserPlugin: Version: 14.4.7 - SDK 10.6 [Click for support]
AdobePDFViewer: Version: 10.1.13 [Click for support]
CouponPrinter-FireFox_v2: Version: Version 1.1.6 [Click for support]
GarminGpsControl: Version: 4.0.4.0 Release - SDK 10.6 [Click for support]
3rd Party Preference Panes: ℹ️
Flash Player [Click for support]
Flip4Mac WMV [Click for support]
Time Machine: ℹ️
Skip System Files: NO
Auto backup: YES
Volumes being backed up:
Macintosh HD: Disk size: 318.84 GB Disk used: 142.29 GB
Destinations:
My Passport for Mac [Local]
Total size: 0 B
Total number of backups: 0
Oldest backup: -
Last backup: -
Size of backup disk: Too small
Backup size 0 B < (Disk used 142.29 GB X 3)
Top Processes by CPU: ℹ️
6% WindowServer
2% Safari
2% hidd
1% Garmin ANT Agent
0% AppleSpell
Top Processes by Memory: ℹ️
257 MB com.apple.WebKit.WebContent
82 MB Safari
73 MB Finder
42 MB WindowServer
39 MB com.apple.WebKit.Networking
Virtual Memory Information: ℹ️
223 MB Free RAM
1.22 GB Active RAM
1.08 GB Inactive RAM
1.10 GB Wired RAM
7.46 GB Page-ins
788 MB Page-outs
Diagnostics Information: ℹ️
Feb 15, 2015, 06:04:38 PM Self test - passedThanks for the help! Yes the memory pressure is light green and swaps is 0. Here is a new Etrecheck report. I don't know what bradfordnetworks is and I'm not sure what do do about the 'failed' mackeeper.
Hardware Information: ℹ️
MacBook Pro (13-inch, Early 2011) (Technical Specifications)
MacBook Pro - model: MacBookPro8,1
1 2.3 GHz Intel Core i5 CPU: 2-core
4 GB RAM Upgradeable
BANK 0/DIMM0
2 GB DDR3 1333 MHz ok
BANK 1/DIMM0
2 GB DDR3 1333 MHz ok
Bluetooth: Old - Handoff/Airdrop2 not supported
Wireless: en1: 802.11 a/b/g/n
Battery Health: Normal - Cycle count 400
Video Information: ℹ️
Intel HD Graphics 3000 - VRAM: 384 MB
Color LCD 1280 x 800
System Software: ℹ️
OS X 10.10.2 (14C109) - Time since boot: 0:3:13
Disk Information: ℹ️
ST9320325ASG disk0 : (320.07 GB)
EFI (disk0s1) <not mounted> : 210 MB
Recovery HD (disk0s3) <not mounted> [Recovery]: 650 MB
Macintosh HD (disk1) / : 318.84 GB (177.33 GB free)
Core Storage: disk0s2 319.21 GB Online
OPTIARC DVD RW AD-5970H
USB Information: ℹ️
Apple Computer, Inc. IR Receiver
Apple Inc. FaceTime HD Camera (Built-in)
Apple Inc. Apple Internal Keyboard / Trackpad
Apple Inc. BRCM2070 Hub
Apple Inc. Bluetooth USB Host Controller
Thunderbolt Information: ℹ️
Apple Inc. thunderbolt_bus
Configuration files: ℹ️
/etc/hosts - Count: 1
Gatekeeper: ℹ️
Mac App Store and identified developers
Launch Daemons: ℹ️
[loaded] com.adobe.fpsaud.plist [Click for support]
[running] com.bradfordnetworks.agent.plist [Click for support]
[loaded] com.ea.origin.ESHelper.plist [Click for support]
[loaded] com.microsoft.office.licensing.helper.plist [Click for support]
User Launch Agents: ℹ️
[loaded] com.adobe.ARM.[...].plist [Click for support]
[loaded] com.google.keystone.agent.plist [Click for support]
[failed] com.zeobit.MacKeeper.Helper.plist [Click for support] [Click for details]
User Login Items: ℹ️
Dropbox Application (/Applications/Dropbox.app)
Garmin ANT Agent Application Hidden (/Applications/Garmin ANT Agent.app)
CSA Application Hidden (/Library/Application Support/Bradford Networks/Persistent Agent/CSA.app)
Internet Plug-ins: ℹ️
Default Browser: Version: 600 - SDK 10.10
Flip4Mac WMV Plugin: Version: 3.0.0.126 - SDK 10.8 [Click for support]
net.juniper.DSSafariExtensions: Version: Unknown [Click for support]
AdobePDFViewerNPAPI: Version: 10.1.13 [Click for support]
FlashPlayer-10.6: Version: 16.0.0.305 - SDK 10.6 [Click for support]
Silverlight: Version: 5.1.20913.0 - SDK 10.6 [Click for support]
Flash Player: Version: 16.0.0.305 - SDK 10.6 [Click for support]
QuickTime Plugin: Version: 7.7.3
iPhotoPhotocast: Version: 7.0 - SDK 10.8
SharePointBrowserPlugin: Version: 14.4.7 - SDK 10.6 [Click for support]
AdobePDFViewer: Version: 10.1.13 [Click for support]
CouponPrinter-FireFox_v2: Version: Version 1.1.6 [Click for support]
GarminGpsControl: Version: 4.0.4.0 Release - SDK 10.6 [Click for support]
3rd Party Preference Panes: ℹ️
Flash Player [Click for support]
Flip4Mac WMV [Click for support]
Time Machine: ℹ️
Skip System Files: NO
Auto backup: YES
Volumes being backed up:
Macintosh HD: Disk size: 318.84 GB Disk used: 141.51 GB
Destinations:
My Passport for Mac [Local]
Total size: 0 B
Total number of backups: 0
Oldest backup: -
Last backup: -
Size of backup disk: Too small
Backup size 0 B < (Disk used 141.51 GB X 3)
Top Processes by CPU: ℹ️
6% WindowServer
4% mds_stores
1% Garmin ANT Agent
0% AppleSpell
0% fontd
Top Processes by Memory: ℹ️
99 MB ocspd
73 MB Dropbox
70 MB mds_stores
60 MB WindowServer
34 MB Dock
Virtual Memory Information: ℹ️
1.58 GB Free RAM
1.30 GB Active RAM
374 MB Inactive RAM
1.04 GB Wired RAM
926 MB Page-ins
0 B Page-outs
Diagnostics Information: ℹ️
Feb 18, 2015, 02:50:30 PM Self test - passed
Feb 17, 2015, 11:02:36 PM /Users/[redacted]/Library/Logs/DiagnosticReports/com.apple.WebKit.WebContent_20 15-02-17-230236_[redacted].crash -
Tracking BSOD at login with CSA 5.2.0.238
I'm trying to identify the cause of this problem and wanted to see if anyone else was experiencing this:
We are getting reports the past few weeks of users logging on in the morning and getting Stop errors and a BSOD or the machine just restarts.
Once they restart and log in all is fine.
These are fully patched XP SP2 machines with the December crop of MS updates (and I'm not ruling those out as a cause).
We use the Novell 4.9 SP2 client, Trend Micro OfficeScan 8 and a few other common apps.
It's not isolated to any particular hardware or software image.
Known:
- We recently upgraded from CSA 4.X to 5.2.0.238 (mid to late December)
- They don't all have the problem (10% is a guestimate for now)
- They don't get it every day
- The machine is on all night at a login prompt (a fresh boot doesn't get it).
I downloaded 5.2.0.245 and upgraded a few clients but haven't got enough feedback yet.
There is nothing in the event logs and the error is a generic stop error 0xC000021A.
The MC doesn't report any anomalies.
I've removed CSA from some machines and the MS updates from others to see what happens.
Just fishing for clues at this point.
TomSorry, that was done many times to no effect.
I have a TAC case open with Cisco on this.
I'll post the results here when I have them.
Tom -
SCCM/WSUS issue after importing March CSA patch bundle
Hi, I am having an issue with security patch deployment since Tuesday night. Debugging is ongoing. I am running SCCM 2012 CU2.
Coincidentally, the problem appeared shortly after importing the March XP CSA (Custom Support Agreement) patch bundle into SCCM. From the client end, WUAHandler.log reported continuous failures/retries. On lower-end machines, system performance
became very poor. From the server end, starting up the Windows Server Update Services mmc (yes, I know you're not supposed to be doing anything in here, which I'm not) results in a connection error. The detailed error message is shown further down.
It was difficult to get the client machines to stop "thrashing" per WUAHandler.log. It wasn't until I de-installed/re-installed WSUS and ASP.NET that things quieted down yesterday afternoon. All appeared to be stable until this morning
when I re-added "Windows XP Custom Support" under the SUP Component Properties tab, imported the CSA bundle info, initiated a CAB synchronization from Microsoft, and re-enabled Software Updates on the clients.
Again, I would get the error when starting up the Windows Server Update Services mmc.
I am doing everything again, but this time one step at a time. My working theory is that there is some kind of corruption caused by the CSA import (this worked just fine up until Feb.). A few hours ago, Microsoft published a new CSA
patch bundle because a patch was apparently forgotten. Is it possible that there was some kind of corruption included with the original bundle published on Tuesday?
I will post what I find as a result of my debugging.
Thanks,
Nick.
The WSUS administration console was unable to connect to the WSUS Server via the remote API.
Verify that the Update Services service, IIS and SQL are running on the server. If the problem persists, try restarting IIS, SQL, and the Update Services Service.
The WSUS administration console has encountered an unexpected error. This may be a transient error; try restarting the administration console. If this error persists,
Try removing the persisted preferences for the console by deleting the wsus file under %appdata%\Microsoft\MMC\.
System.IO.IOException -- The handshake failed due to an unexpected packet format.
Source
System
Stack Trace:
at System.Net.Security.SslState.StartReadFrame(Byte[] buffer, Int32 readBytes, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.StartReceiveBlob(Byte[] buffer, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.ForceAuthentication(Boolean receiveFirst, Byte[] buffer, AsyncProtocolRequest asyncRequest)
at System.Net.Security.SslState.ProcessAuthentication(LazyAsyncResult lazyResult)
at System.Threading.ExecutionContext.runTryCode(Object userData)
at System.Runtime.CompilerServices.RuntimeHelpers.ExecuteCodeWithGuaranteedCleanup(TryCode code, CleanupCode backoutCode, Object userData)
at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state)
at System.Net.TlsStream.ProcessAuthentication(LazyAsyncResult result)
at System.Net.TlsStream.Write(Byte[] buffer, Int32 offset, Int32 size)
at System.Net.PooledStream.Write(Byte[] buffer, Int32 offset, Int32 size)
at System.Net.ConnectStream.WriteHeaders(Boolean async)
** this exception was nested inside of the following exception **
System.Net.WebException -- The underlying connection was closed: An unexpected error occurred on a send.
Source
Microsoft.UpdateServices.Administration
Stack Trace:
at Microsoft.UpdateServices.Administration.AdminProxy.CreateUpdateServer(Object[] args)
at Microsoft.UpdateServices.Administration.AdminProxy.GetUpdateServer(String serverName, Boolean useSecureConnection, Int32 portNumber)
at Microsoft.UpdateServices.UI.AdminApiAccess.AdminApiTools.GetUpdateServer(String serverName, Boolean useSecureConnection, Int32 portNumber)
at Microsoft.UpdateServices.UI.SnapIn.Scope.ServerSummaryScopeNode.GetUpdateServer(PersistedServerSettings settings)
at Microsoft.UpdateServices.UI.SnapIn.Scope.ServerSummaryScopeNode.ConnectToServer()
at Microsoft.UpdateServices.UI.SnapIn.Scope.ServerSummaryScopeNode.ConnectToServerAndPopulateNode(Boolean connectingServerToConsole)
at Microsoft.UpdateServices.UI.SnapIn.Scope.ServerSummaryScopeNode.OnExpandFromLoad(SyncStatus status)Yes, WCM.log showed the same 503 error starting on the Wednesday morning at 2:53am, and I also noticed wsuspool had stopped. My most noticeable symptom was the thrashing of wuahandler.log on the clients, causing poor system performance on machines with 2gb
of memory. Multiple de-installs/re-installs of WSUS failed to clear the issue until we increased the memory setting in IIS.
Nick
WCM.log:
System.Net.WebException: The request failed with HTTP status 503: Service Unavailable.~~ at Microsoft.UpdateServices.Administration.AdminProxy.CreateUpdateServer(Object[] args)~~ at Microsoft.SystemsManagementServer.WSUS.WSUSServer.ConnectToWSUSServer(String
ServerName, Boolean UseSSL, Int32 PortNumber) $$<SMS_WSUS_CONFIGURATION_MANAGER><03-11-2015 02:53:26.225+240><thread=30872 (0x7898)>
Remote configuration failed on WSUS Server.~ $$<SMS_WSUS_CONFIGURATION_MANAGER><03-11-2015 02:53:26.226+240><thread=30872 (0x7898)> -
Hi is there a way to do a host summary report that gives me a list of all of the hosts and their current status.
I know I can run a detail report but this gives me pages and pages of information, and I can run a management report (host count) which is great.
But... What I would like is a one page report that provides me with the host name description and if the are active or not. Similar to the information contained on the system/host screen on CSA.
I am running v6.0.1.106
Many thanks
Ian VickeryIan,
Probably the easiest way to get a report with just these 3 data fields would be to query the database directly. Otherwise you could use the API and parse the output for those fields:
http://www.cisco.com/en/US/docs/security/csa/csa601/user_guide/Scripting_Interface.html#wp965225
If you are looking for this report just to find which hosts are not active the I would recommend using the host search with your criteria.
Thanks,
Josh -
CSA - Sort Client/Server Licensces by group??
As Cisco CSA license charges are signficantly different from between server and client agents, we need a method, report, SQL query to be able to determine the number servers and number clients used in a given group. This is to allow internal "charge backs" to occur, and given the difference between server and client licenscing costs - the total of servers and clients is available via the "Maintenance -> License Info" tab, but there is no way to see lists of clients or servers, or do seachs/breakdowns of this info by group, or even a report that allows one to import this data into excel - Even a "SQL query" against the appropiate SQL database fields would be workable - We just need access to this licenscing info in some fashion - Any thoughts out there?
Answered this in "General" group.
Tom S -
CSA MC Events Log and Agent Panel Events Corrolation
I have recently install CSA MC 6.0.0.201 and the agent on a Win2003 server. I have a question of events showing up in the agent panel and not showing up in the MC events log.
I see a number of events in the agent 'panel' event viewer. At the end of the event is a number in brackets like [176].
When I look at the MC event viewer but those events are not being reported.
My query is:
#1 I believe the example [176} is the rule being triggered. So if the event is not showing up in the event viewer how to I find that rule in the policies? I finally did stumble across the rule and I see that logging is disabled for that rule, but finding that rule was a needle in the haystack search. Is there an easier way to find rules?
#2 Maybe I do not understand this part but in the MC I placed this server (the one with the MC) into 'Audit Mode' in hopes that would get the events from the agent to show up in the MC event log. No good. Is there a way to get all events - even if the rule says to not log the event - so show up in the MC log so I can creat an exception?
Thanks
LarryTom,
I think I may have made some progress. Yes I'm in advanced mode. I went into Systems | Groups and first selected the 'Servers' and turned on logging. Still most the events in the agent event viewer were not making it to the MC event log.
So I went back in to the Systems | Groups and found there was a group called 'Servers - CSA Management Center' and turned on logging there and that got the events to start flowing into the MC events.
Maybe this will help me get going.
Larry -
CSA v5.1 - v5.2 Upgrade
Hello,
Just a question on upgrade. When upgrading from CSA MC v5.1 -> v5.2, will the v5.1 client still report to the MC before the it is upgraded to v5.2? Thanks,Yes, your clients with the 5.1 agent will still report to the same CSA Management Center after you perform an upgrade to 5.2.
Hope this helps.
Maybe you are looking for
-
I've been connecting a sony PD170 via firewire to my Macbook pro to record directly using Quicktime pro. Can I use the usb port (and mini audio in) to accomplish this with a camcorder that doesn't have a fire wire port but does have USB out?
-
I have an OLD TV. Can I use Apple TV?
I have this old box of a tv. Maybe a 2002 model? I believe it's a samsung and it's got a VHS and DVD player in it; flat screen, but NOT the type of flat screen that we know and use today, only the front face is flat. It has an analog cable outlet for
-
Can't get tv show that I once used to get
I used to download Monk tv show and now I can't...where did it go? Now it says it is in another countries store. Did they move it?
-
How do I resolve install error U44M1P7 InDesign CC
How do I resolve an installation error U44M1P7 associated with a problem with updating InDesign CC. I have uninstalled and reinstalled the program on a number of occasions. This updown error means I can no longer use the program. I have deleted the
-
How do I turn off temperature alerts in Calendar
Since upgrading to Mavericks, my calendar on every day is displaying the high and low temperature for the city I live in (in fact 3 sets of temperature for the same day!) and also putting up alerts of same in the upper right hand corner of my iMac. I