RMA Cannot Send Data ERROR?

[frilby]

I am currently running hostMonitor V6.10 on Server 2003 (fully patched) and across approximately 30 servers (all running Server 2003 / RMA agent V3.35) I am having no problems, with one exception:

On one server (same configuration as the rest) I am regularly getting the following RMA error returned intermittently (as the result for the test) across a number of tests for the server:

"RMA: Cannot send data. An existing connection was forcibly closed by the remote host."

I have checked the timeout settings for both the RMA manager configuration on the HostMonitor server as well as the RMA service on the remote server (both set to 120 seconds).

If I refresh any of the tests that return the above error they return a normal response.

Across the 30 server fleet the hardware/software builds are consistent (built from a standard OS "image") and the range of tests are also identical (with some additional "server specific" tests added per system).

The servers are high spec and the affected server does not appear to be working excessively hard (it's a centralised tape backup server that is typically operating overnight and fairly dormant during the day - when errors are still occuring).

Any idea what may be the cause of this error (or what this error means in more detail so that I can troubleshoot it further)?

Cheers,
Frilby

[KS-Soft Europe]

"RMA: Cannot send data. An existing connection was forcibly closed by the remote host."

What exactly test returns such error?

Regards,
Max

[KS-Soft]

Any idea what may be the cause of this error (or what this error means in more detail so that I can troubleshoot it further)?

This means the following:
- HostMonitor sent connection request to RMA
- RMA accepted connection
- HostMonitor tries to send test request but TCP connection is dropped by RMA(??) or most likely by some 3rd party application (like antivirus monitor or personal firewall).
Could you check log files (log1.txt and log2.txt) located in RMA directory. If there are no errors, some 3rd party software drops connection.

Regards
Alex

[frilby]

Alex,

Log1.txt is showing successful connections with no issues.

Log2.txt is only showing a couple of errors a day which does nto correspond to the frequency I am seeing in HostMonitor (I can refresh a folder and have the RMA test for the problem server error every second or third refresh with no corresponding error in Log2.txt). As you have indicated, does this mean it is most likely an application or OS issues other than RMA dropping the connection?

The Log2.txt errors received are as follows:

[14/08/2006 4:48 PM] 10.x.x.x Windows socket error: An existing connection was forcibly closed by the remote host (10054), on API 'send'
[14/08/2006 10:24 PM] 10.x.x.x Windows socket error: An established connection was aborted by the software in your host machine (10053), on API 'send'
[15/08/2006 6:01 PM] 10.x.x.x Windows socket error: An existing connection was forcibly closed by the remote host (10054), on API 'send'
[15/08/2006 9:43 PM] 10.x.x.x Windows socket error: An established connection was aborted by the software in your host machine (10053), on API 'send'
[15/08/2006 9:44 PM] 10.x.x.x Windows socket error: An established connection was aborted by the software in your host machine (10053), on API 'send'
[15/08/2006 10:20 PM] 10.x.x.x Windows socket error: An established connection was aborted by the software in your host machine (10053), on API 'send'
[16/08/2006 4:55 AM] 10.x.x.x Windows socket error: An established connection was aborted by the software in your host machine (10053), on API 'send'

As the build of these servers is based on the same OS "image" I will need to dig a little deeper and see what is going on on this box...

Cheers,
Frilby

[KS-Soft]

As you have indicated, does this mean it is most likely an application or OS issues other than RMA dropping the connection?
The Log2.txt errors received are as follows:
[14/08/2006 4:48 PM] 10.x.x.x Windows socket error: An existing connection was forcibly closed by the remote host (10054), on API 'send'

Yes, definitely. Some 3rd party application drops connection. Probably some antivirus, personal firewall or conent monitoring software...

Regards
Alex

[TalT]

No anti virus is installed and the windows firewall is disabled.
I get the "RMA: Cannot read data. An existing connection was forcibly closed by the remote host." once in 10 runs of the test.
The "Windows socket error: An existing connection was forcibly closed by the remote host (10054), on API 'send' " message also appears in the log

[KS-Soft]

Sorry, I do not see how we can help you
Could you use some network packet analyzer (sniffer) to check why connection is dropped?

Regards
Alex