Live update killing filestore

Question

hi all,
seems like the scheduled live update task completely removes the filestore share on every run on our server (at least file access auditing revealed that the share (which lives on the same machine as task and collection server) got deleted by the service account some 90 seconds after the LU started) any ideas how that can happen or how to avoid this?
Environment is win2ksp4 server, zam 7.50.0012 IR1 (enterprise install, all components on the same machine), mssql2000sp4.
thanks, Lothar

Answer 1

Jared Jennings wrote:
> Do you have some previous tskmgr logs you could send me from before when you stopped live update?
here's the LU part of the log for the last time the filestore got deleted::
<EVENT AT="3/15/2007 7:01:36 AM" SEVERITY="Info">
CApplyUpdateTask::OnStartTask()
</EVENT>
<EVENT AT="3/15/2007 7:01:37 AM" SEVERITY="Info">
Update Progress...Connecting to Website (1, 2, 0)
</EVENT>
<EVENT AT="3/15/2007 7:01:37 AM" SEVERITY="Info">
Accessing internet using the following information:
Web Server: 207.121.71.11
File pru/pru.asp
Access Type: Non-Proxy
Proxy Server: <not used>
Proxy Port: 80
Proxy Username: <not used>
Proxy Password: <not used>
</EVENT>
<EVENT AT="3/15/2007 7:01:38 AM" SEVERITY="Info">
Successful data retrieval
</EVENT>
<EVENT AT="3/15/2007 7:01:38 AM" SEVERITY="Info">
UpdateXml: http://ftp2.novell.com/partners/tall.../iv/update.xml
</EVENT>
<EVENT AT="3/15/2007 7:01:38 AM" SEVERITY="Info">
Update Progress...Retrieving Update (2, 2, 0)
</EVENT>
<EVENT AT="3/15/2007 7:01:38 AM" SEVERITY="Info">
Attempting download of update.xml: http://ftp2.novell.com/partners/tall.../iv/update.xml
</EVENT>
<EVENT AT="3/15/2007 7:01:39 AM" SEVERITY="Info">
Downloaded update.xml
</EVENT>
<EVENT AT="3/15/2007 7:01:39 AM" SEVERITY="Info">
NCGuiRes.dll_1165606530330.tsz has already been applied, skipping...
</EVENT>
<EVENT AT="3/15/2007 7:01:39 AM" SEVERITY="Info">
NetDisc.dll_1165606533224.tsz has already been applied, skipping...
</EVENT>
<EVENT AT="3/15/2007 7:01:39 AM" SEVERITY="Info">
COLLECT.BAT_1165600497085.tsz has already been applied, skipping...
</EVENT>
<EVENT AT="3/15/2007 7:01:39 AM" SEVERITY="Info">
COLLECT2.BAT_1165600496384.tsz has already been applied, skipping...
</EVENT>
<EVENT AT="3/15/2007 7:01:39 AM" SEVERITY="Info">
CHEKPATH.exe_1165600495072.tsz has already been applied, skipping...
</EVENT>
<EVENT AT="3/15/2007 7:01:39 AM" SEVERITY="Info">
TaskServerCore.exe_1165606541186.tsz has already been applied, skipping...
</EVENT>
<EVENT AT="3/15/2007 7:01:39 AM" SEVERITY="Info">
spacew32.exe_1165600519457.tsz has already been applied, skipping...
</EVENT>
<EVENT AT="3/15/2007 7:01:39 AM" SEVERITY="Info">
Dbp.dll_1166024660081.tsz has already been applied, skipping...
</EVENT>
<EVENT AT="3/15/2007 7:01:39 AM" SEVERITY="Info">
Portable.ini_1165600511465.tsz has already been applied, skipping...
</EVENT>
<EVENT AT="3/15/2007 7:01:39 AM" SEVERITY="Info">
TSCMgr.ex__1166024661633.tsz has already been applied, skipping...
</EVENT>
<EVENT AT="3/15/2007 7:01:39 AM" SEVERITY="Info">
Cvrt2Wif.dll_1165937067019.tsz has already been applied, skipping...
</EVENT>
<EVENT AT="3/15/2007 7:01:39 AM" SEVERITY="Info">
LOGAPPND.exe_1165600505857.tsz has already been applied, skipping...
</EVENT>
<EVENT AT="3/15/2007 7:01:39 AM" SEVERITY="Info">
FINDST.exe_1165600504125.tsz has already been applied, skipping...
</EVENT>
<EVENT AT="3/15/2007 7:01:39 AM" SEVERITY="Info">
END.BAT_1165600503163.tsz has already been applied, skipping...
</EVENT>
<EVENT AT="3/15/2007 7:01:39 AM" SEVERITY="Info">
Aobj.dll_1165606522689.tsz has already been applied, skipping...
</EVENT>
<EVENT AT="3/15/2007 7:01:39 AM" SEVERITY="Info">
Colw32.exe_1165606525804.tsz has already been applied, skipping...
</EVENT>
<EVENT AT="3/15/2007 7:01:39 AM" SEVERITY="Info">
tscclient_1165600526137.tsz has already been applied, skipping...
</EVENT>
<EVENT AT="3/15/2007 7:01:39 AM" SEVERITY="Info">
IRScriptsM.SQL_1165851603648.tsz has already been applied, skipping...
</EVENT>
<EVENT AT="3/15/2007 7:01:39 AM" SEVERITY="Info">
IRScriptsO.SQL_1169131702194.tsz has already been applied, skipping...
</EVENT>
<EVENT AT="3/15/2007 7:01:39 AM" SEVERITY="Info">
ZAMSTR.BAT_1165600523222.tsz has already been applied, skipping...
</EVENT>
<EVENT AT="3/15/2007 7:01:39 AM" SEVERITY="Info">
rtrlet.war_1166197405414.tsz has already been applied, skipping...
</EVENT>
<EVENT AT="3/15/2007 7:01:39 AM" SEVERITY="Info">
Removing files already applied
</EVENT>
<EVENT AT="3/15/2007 7:01:39 AM" SEVERITY="Info">
Files to remove: 21
</EVENT>
<EVENT AT="3/15/2007 7:01:39 AM" SEVERITY="Info">
Removed files, file list count: 0
</EVENT>
<EVENT AT="3/15/2007 7:01:39 AM" SEVERITY="Info">
Update Progress...Verifying (5, 2, 0)
</EVENT>
<EVENT AT="3/15/2007 7:01:39 AM" SEVERITY="Info">
Application Object Info at 3/15/2007 7:01:39 AM on HAMBURGASSET01 by ZAM_Techuser
Update Already Applied
[2.4.1652] The update has already been applied to your ZENworks Asset Management installation.
</EVENT>
<EVENT AT="3/15/2007 7:01:39 AM" SEVERITY="Info">
Update Progress...Update Complete (0, 0, 0)
</EVENT>
<EVENT AT="3/15/2007 7:01:39 AM" SEVERITY="Info">
CApplyUpdateTask::Completed()
</EVENT>
and here's what the event log says (newest event first):
3/15/2007 7:01:39 AM Security Success Audit Object Access 562 DOM-ADMIN\ZAM_Techuser HAMBURGASSET01 "Handle Closed:
Object Server: Security
Handle ID: 1080
Process ID: 5736
3/15/2007 7:01:39 AM Security Success Audit Object Access 564 DOM-ADMIN\ZAM_Techuser HAMBURGASSET01 "Object Deleted:
Object Server: Security
Handle ID: 1080
Process ID: 5736
3/15/2007 7:01:39 AM Security Success Audit Object Access 560 DOM-ADMIN\ZAM_Techuser HAMBURGASSET01 "Object Open:
Object Server: Security
Object Type: File
Object Name: D:\FileStore
New Handle ID: 1080
Operation ID: {0,32279507}
Process ID: 5736
Primary User Name: ZAM_Techuser
Primary Domain: DOM-ADMIN
Primary Logon ID: (0x0,0xBFF48F)
Client User Name: -
Client Domain: -
Client Logon ID: -
Accesses DELETE
SYNCHRONIZE
ReadAttributes
Privileges -
3/15/2007 7:01:39 AM Security Success Audit Object Access 562 DOM-ADMIN\ZAM_Techuser HAMBURGASSET01 "Handle Closed:
Object Server: Security
Handle ID: 1136
Process ID: 5736
3/15/2007 7:01:39 AM Security Success Audit Object Access 564 DOM-ADMIN\ZAM_Techuser HAMBURGASSET01 "Object Deleted:
Object Server: Security
Handle ID: 1136
Process ID: 5736
3/15/2007 7:01:39 AM Security Success Audit Object Access 560 DOM-ADMIN\ZAM_Techuser HAMBURGASSET01 "Object Open:
Object Server: Security
Object Type: File
Object Name: D:\FileStore\FILESTORE
New Handle ID: 1136
Operation ID: {0,32279504}
Process ID: 5736
Primary User Name: ZAM_Techuser
Primary Domain: DOM-ADMIN
Primary Logon ID: (0x0,0xBFF48F)
Client User Name: -
Client Domain: -
Client Logon ID: -
Accesses DELETE
SYNCHRONIZE
ReadAttributes
Privileges -