HostMonitor unexpectedly quits!

monitorcsn001 · Post by **monitorcsn001** » Tue Dec 12, 2006 8:59 am

Hello everyone.
in essence, my problem is that HM 6.42c will suddenly crash.

We have installed the sw on a Windows 2003 Server R2 Sp1 + fully patched and on a Windows 2000 SP4 and the problem occurs on both platforms.

Hardware is a 2 processor 3GHz Xeon server with 8GB ram (tried with HyperThreading on and off).

I've seen this often asked in other threads for better analysis, so I'll let you know we have:

- ODBC logging on
- SQL 2000 client tools

Previously I had version 4.6 with the same DB server on a 1 proc server and never had any problems.

What else can I tell you to help analyze the problem?
Thanks in advance.
P.

KS-Soft Europe · Post by **KS-Soft Europe** » Tue Dec 12, 2006 9:29 am

Could you please provide more information?
- Is HostMonitor started as service or as application?
- Do you have installed antivirus monitor? Personal firewall? Content monitoring software? Non-standard winsock components? Network packet analyzer?
- Do you see any errors in system log (file is specified in Options > System Log tab)?
- Do you see any error messages in Event Viewer (Start > Settings > Control Panel > Administrative Tools > Event Viewer applet)?
- Can you check resource usage for each process? You may use standard Windows Task Manager to check Handles, GDI and USER objects. What the total resource usage on your system? What applications uses the most handles?

Regards,
Max

monitorcsn001 · Post by **monitorcsn001** » Tue Dec 12, 2006 9:55 am

I have tried starting HostMonitor both as service and as application.
installed Antivirus is TrendMicro.
no firewall towards my server farm.
no non-standard winsock components.
no network packet analyzers.
when HostMonitor crashes, there's no trace of any errors in System or Application Log (Event Viewer), nor in HM's system Log tab.
I'll let you know about resource usage later...

KS-Soft Europe · Post by **KS-Soft Europe** » Tue Dec 12, 2006 10:09 am

monitorcsn001 wrote:when HostMonitor crashes, there's no trace of any errors in System or Application Log (Event Viewer), nor in HM's system Log tab.

How does it crash? Does it show any pop-up window, error messages? Or just disapears? Probably it freezes before crash for some period of time? Not responding? How does it look like? How long does it work before crash? Do you use Terminal Service to access to the machine, where HostMonitor is running? Do you use proper account to start host monitor as service (Options > Service tab)?

monitorcsn001 wrote:I'll let you know about resource usage later...

Yes, please. It might be the resource allocation error, so we need this information.

Regards,
Max

monitorcsn001 · Post by **monitorcsn001** » Wed Dec 13, 2006 2:52 am

KS-Soft Europe wrote:How does it crash?

Unexpectedly!
It crashes mostly at night, so it's when I'm not present.
The next morning I don't see any pop-ups or error messages - just that HostMonitor has mysteriously disappeared.

I mostly use RCC to access and work with HostMonitor.

HostMonitor is started as a local application on the server and it was created with an account that's both domain and local administrator. Does this answer your question?

Thanks and regards,
P.

KS-Soft Europe · Post by **KS-Soft Europe** » Wed Dec 13, 2006 3:43 am

So, what about resourse usage? Could you please check resource usage for each process? You may use standard Windows Task Manager to check Handles, GDI and USER objects. What the total resource usage? What process uses the most of resources?

Regards,
Max

monitorcsn001 · Post by **monitorcsn001** » Wed Dec 13, 2006 7:55 am

KS-Soft Europe wrote:So, what about resourse usage?

Oh, yeah! Sorry, I forgot.
I wanted to take a screen capture and I tried to find a place to uplaod the image, but I think I'll just type it in here instead.

I've logged on to the machine for the first time (I'm only translating for the coleague who's actually in charge of HostMonitor). And I saw the error pop-up for this morning at 03.15 (it's now 14.20 here).

Here's that pop-up:

hostmon.exe wrote:Error signature
szAppName : hostmon.exe szAppVer : 6.40.0.421 szModName : kernel32.dll
szModVer : 5.2.3790.275 offset : 00015e02

Reporting details
bla bla bla bla bla

In that window, I then clicked here to view the error report whoch pointed me to a 52MB dump file (hostmon.exe.mdmp) and an text file (appcompat.txt) whose contents are below:

Code: Select all

<?xml version="1.0" encoding="UTF-16"?>
<DATABASE>
<EXE NAME="hostmon.exe" FILTER="GRABMI_FILTER_PRIVACY">
    <MATCHING_FILE NAME="hostmon.exe" SIZE="4239360" CHECKSUM="0xC008152E" BIN_FILE_VERSION="6.40.0.421" BIN_PRODUCT_VERSION="6.40.0.421" PRODUCT_VERSION="6" FILE_DESCRIPTION="Advanced Host Monitor" COMPANY_NAME="KS-Soft" PRODUCT_NAME="Advanced Host Monitor" FILE_VERSION="6.40.0.421" ORIGINAL_FILENAME="hostmon.exe" INTERNAL_NAME="HostMonitor" LEGAL_COPYRIGHT="(c) by Alexander Kozlov" VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x4" VERFILETYPE="0x1" MODULE_TYPE="WIN32" PE_CHECKSUM="0x0" LINKER_VERSION="0x0" UPTO_BIN_FILE_VERSION="6.40.0.421" UPTO_BIN_PRODUCT_VERSION="6.40.0.421" LINK_DATE="06/19/1992 22:22:17" UPTO_LINK_DATE="06/19/1992 22:22:17" VER_LANGUAGE="English (Canada) [0x1009]" />
    <MATCHING_FILE NAME="LogsMan.exe" SIZE="1651200" CHECKSUM="0xB6293585" MODULE_TYPE="WIN32" PE_CHECKSUM="0x0" LINKER_VERSION="0x0" LINK_DATE="06/19/1992 22:22:17" UPTO_LINK_DATE="06/19/1992 22:22:17" />
    <MATCHING_FILE NAME="mibbrowser.exe" SIZE="638976" CHECKSUM="0xA484956F" MODULE_TYPE="WIN32" PE_CHECKSUM="0x0" LINKER_VERSION="0x0" LINK_DATE="06/19/1992 22:22:17" UPTO_LINK_DATE="06/19/1992 22:22:17" />
    <MATCHING_FILE NAME="perfobj.exe" SIZE="67072" CHECKSUM="0xA593847F" MODULE_TYPE="WIN32" PE_CHECKSUM="0x0" LINKER_VERSION="0x0" LINK_DATE="06/19/1992 22:22:17" UPTO_LINK_DATE="06/19/1992 22:22:17" />
    <MATCHING_FILE NAME="powerp32.dll" SIZE="110592" CHECKSUM="0xA0867E3A" BIN_FILE_VERSION="2.1.3.0" BIN_PRODUCT_VERSION="2.1.3.0" PRODUCT_VERSION="2.13" FILE_DESCRIPTION="Power Page 32-bit Dynamic Link Library" COMPANY_NAME="Tanner and Associates - Ron Tanner - (303) 689-0720 - E-mail: ron@ntpage.com" PRODUCT_NAME="Power Page" FILE_VERSION="2.13 - Registered" ORIGINAL_FILENAME="POWERP32.DLL" INTERNAL_NAME="POWERP32" LEGAL_COPYRIGHT="Copyright© Ron Tanner 1995-2000" VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x40004" VERFILETYPE="0x2" MODULE_TYPE="WIN32" PE_CHECKSUM="0x0" LINKER_VERSION="0x0" UPTO_BIN_FILE_VERSION="2.1.3.0" UPTO_BIN_PRODUCT_VERSION="2.1.3.0" LINK_DATE="05/29/2001 14:58:23" UPTO_LINK_DATE="05/29/2001 14:58:23" VER_LANGUAGE="English (United States) [0x409]" />
    <MATCHING_FILE NAME="rcc.exe" SIZE="3456512" CHECKSUM="0xEB6238E0" BIN_FILE_VERSION="1.80.0.35" BIN_PRODUCT_VERSION="1.80.0.35" PRODUCT_VERSION="1.0.0.0" FILE_DESCRIPTION="Remote Control Console for HostMonitor" COMPANY_NAME="KS-Soft" PRODUCT_NAME="RCC" FILE_VERSION="1.80.0.35" ORIGINAL_FILENAME="rcc.exe" INTERNAL_NAME="RCC" LEGAL_COPYRIGHT="(c) by Alexandre Kozlov" VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x4" VERFILETYPE="0x1" MODULE_TYPE="WIN32" PE_CHECKSUM="0x0" LINKER_VERSION="0x0" UPTO_BIN_FILE_VERSION="1.80.0.35" UPTO_BIN_PRODUCT_VERSION="1.80.0.35" LINK_DATE="06/19/1992 22:22:17" UPTO_LINK_DATE="06/19/1992 22:22:17" VER_LANGUAGE="English (United States) [0x409]" />
    <MATCHING_FILE NAME="rma_mgr.exe" SIZE="852480" CHECKSUM="0x21339A34" MODULE_TYPE="WIN32" PE_CHECKSUM="0x0" LINKER_VERSION="0x0" LINK_DATE="06/19/1992 22:22:17" UPTO_LINK_DATE="06/19/1992 22:22:17" />
    <MATCHING_FILE NAME="telnetservice.exe" SIZE="567808" CHECKSUM="0xA3469597" MODULE_TYPE="WIN32" PE_CHECKSUM="0x0" LINKER_VERSION="0x0" LINK_DATE="06/19/1992 22:22:17" UPTO_LINK_DATE="06/19/1992 22:22:17" />
    <MATCHING_FILE NAME="UnInstal.exe" SIZE="848384" CHECKSUM="0x3B0180F9" MODULE_TYPE="WIN32" PE_CHECKSUM="0x0" LINKER_VERSION="0x0" LINK_DATE="06/19/1992 22:22:17" UPTO_LINK_DATE="06/19/1992 22:22:17" />
    <MATCHING_FILE NAME="wmiexplorer.exe" SIZE="658432" CHECKSUM="0x99461E3A" MODULE_TYPE="WIN32" PE_CHECKSUM="0x0" LINKER_VERSION="0x0" LINK_DATE="06/19/1992 22:22:17" UPTO_LINK_DATE="06/19/1992 22:22:17" />
    <MATCHING_FILE NAME="Examples\errorlev.exe" SIZE="36864" CHECKSUM="0xCDF89E64" MODULE_TYPE="WIN32" PE_CHECKSUM="0x0" LINKER_VERSION="0x0" LINK_DATE="06/19/1992 22:22:17" UPTO_LINK_DATE="06/19/1992 22:22:17" />
    <MATCHING_FILE NAME="RMA-Win\rma.exe" SIZE="685568" CHECKSUM="0xDC272337" MODULE_TYPE="WIN32" PE_CHECKSUM="0x0" LINKER_VERSION="0x0" LINK_DATE="06/19/1992 22:22:17" UPTO_LINK_DATE="06/19/1992 22:22:17" />
    <MATCHING_FILE NAME="RMA-Win\rma_cfg.exe" SIZE="563712" CHECKSUM="0xF36F91A8" MODULE_TYPE="WIN32" PE_CHECKSUM="0x0" LINKER_VERSION="0x0" LINK_DATE="06/19/1992 22:22:17" UPTO_LINK_DATE="06/19/1992 22:22:17" />
    <MATCHING_FILE NAME="Utils\appstatus\appstatus.exe" SIZE="65536" CHECKSUM="0xBE2B95A6" MODULE_TYPE="WIN32" PE_CHECKSUM="0x0" LINKER_VERSION="0x0" LINK_DATE="06/19/1992 22:22:17" UPTO_LINK_DATE="06/19/1992 22:22:17" />
    <MATCHING_FILE NAME="Utils\kill\kill.exe" SIZE="64512" CHECKSUM="0x3045609" MODULE_TYPE="WIN32" PE_CHECKSUM="0x0" LINKER_VERSION="0x0" LINK_DATE="06/19/1992 22:22:17" UPTO_LINK_DATE="06/19/1992 22:22:17" />
    <MATCHING_FILE NAME="Utils\powercheck\powercheck.exe" SIZE="46080" CHECKSUM="0xD6F77258" MODULE_TYPE="WIN32" PE_CHECKSUM="0x0" LINKER_VERSION="0x0" LINK_DATE="06/19/1992 22:22:17" UPTO_LINK_DATE="06/19/1992 22:22:17" />
    <MATCHING_FILE NAME="Utils\RmaInstaller\rmainstaller.exe" SIZE="66048" CHECKSUM="0x50442875" MODULE_TYPE="WIN32" PE_CHECKSUM="0x0" LINKER_VERSION="0x0" LINK_DATE="06/19/1992 22:22:17" UPTO_LINK_DATE="06/19/1992 22:22:17" />
    <MATCHING_FILE NAME="WebService\webservice.exe" SIZE="973312" CHECKSUM="0x90F80B8A" BIN_FILE_VERSION="2.80.0.35" BIN_PRODUCT_VERSION="2.80.0.35" PRODUCT_VERSION="" FILE_DESCRIPTION="Web Service for HostMonitor" COMPANY_NAME="KS-Soft" PRODUCT_NAME="" FILE_VERSION="2.80.0.35" ORIGINAL_FILENAME="webservice.exe" INTERNAL_NAME="WebService" LEGAL_COPYRIGHT="(c) by Alexandre Kozlov" VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x4" VERFILETYPE="0x1" MODULE_TYPE="WIN32" PE_CHECKSUM="0x0" LINKER_VERSION="0x0" UPTO_BIN_FILE_VERSION="2.80.0.35" UPTO_BIN_PRODUCT_VERSION="2.80.0.35" LINK_DATE="06/19/1992 22:22:17" UPTO_LINK_DATE="06/19/1992 22:22:17" VER_LANGUAGE="English (United States) [0x409]" />
</EXE>
<EXE NAME="kernel32.dll" FILTER="GRABMI_FILTER_THISFILEONLY">
    <MATCHING_FILE NAME="kernel32.dll" SIZE="1038848" CHECKSUM="0xFDE4CF7D" BIN_FILE_VERSION="5.2.3790.2756" BIN_PRODUCT_VERSION="5.2.3790.2756" PRODUCT_VERSION="5.2.3790.2756" FILE_DESCRIPTION="Windows NT BASE API Client DLL" COMPANY_NAME="Microsoft Corporation" PRODUCT_NAME="Microsoft® Windows® Operating System" FILE_VERSION="5.2.3790.2756 (srv03_sp1_gdr.060725-0040)" ORIGINAL_FILENAME="kernel32" INTERNAL_NAME="kernel32" LEGAL_COPYRIGHT="© Microsoft Corporation. All rights reserved." VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x40004" VERFILETYPE="0x2" MODULE_TYPE="WIN32" PE_CHECKSUM="0x1059A9" LINKER_VERSION="0x50002" UPTO_BIN_FILE_VERSION="5.2.3790.2756" UPTO_BIN_PRODUCT_VERSION="5.2.3790.2756" LINK_DATE="07/25/2006 12:31:53" UPTO_LINK_DATE="07/25/2006 12:31:53" VER_LANGUAGE="English (United States) [0x409]" />
</EXE>
<EXE NAME="kernel32.dll" FILTER="GRABMI_FILTER_THISFILEONLY">
    <MATCHING_FILE NAME="kernel32.dll" SIZE="1038848" CHECKSUM="0xFDE4CF7D" BIN_FILE_VERSION="5.2.3790.2756" BIN_PRODUCT_VERSION="5.2.3790.2756" PRODUCT_VERSION="5.2.3790.2756" FILE_DESCRIPTION="Windows NT BASE API Client DLL" COMPANY_NAME="Microsoft Corporation" PRODUCT_NAME="Microsoft® Windows® Operating System" FILE_VERSION="5.2.3790.2756 (srv03_sp1_gdr.060725-0040)" ORIGINAL_FILENAME="kernel32" INTERNAL_NAME="kernel32" LEGAL_COPYRIGHT="© Microsoft Corporation. All rights reserved." VERFILEDATEHI="0x0" VERFILEDATELO="0x0" VERFILEOS="0x40004" VERFILETYPE="0x2" MODULE_TYPE="WIN32" PE_CHECKSUM="0x1059A9" LINKER_VERSION="0x50002" UPTO_BIN_FILE_VERSION="5.2.3790.2756" UPTO_BIN_PRODUCT_VERSION="5.2.3790.2756" LINK_DATE="07/25/2006 12:31:53" UPTO_LINK_DATE="07/25/2006 12:31:53" VER_LANGUAGE="English (United States) [0x409]" />
</EXE>
</DATABASE>

Still want the resource usage?
Regards,
P.

KS-Soft Europe · Post by **KS-Soft Europe** » Wed Dec 13, 2006 8:22 am

monitorcsn001 wrote:Here's that pop-up:
hostmon.exe wrote:Error signature
szAppName : hostmon.exe szAppVer : 6.40.0.421 szModName : kernel32.dll
szModVer : 5.2.3790.275 offset : 00015e02

Reporting details
bla bla bla bla bla

Ups. Such error means, there should be an error in Event log with description like "Faulting application hostmon.exe, version 0.0.0.0, faulting module kernel32.dll, version..." or some "access violation" message. Have you seen the one?

monitorcsn001 wrote:Still want the resource usage?

Yes, exactly. Such errors could be caused by lack of resources and to figure it out I need to show what is going on with your system. I am interested in a total resource usage (Performance tab of the Task Manager) and resource usage by each process (Processes tab of the Task Manager). Could you provide this information?

Regards,
Max

monitorcsn001 · Post by **monitorcsn001** » Wed Dec 13, 2006 9:52 am

Here's a snapshot of this moment in time....

Performance tab:

Totals-----------------Physical Mem (K)----------
-Handles----11050----Total------------8386680
-Threads-------642----Available-------7606200
-Processes------60----System Cache-1937156
------------------------------------------------------
Commit Charge (K)----Kernel Mem (K)---------
-Total--------458600-----Total----------248636
-Limit------10281792----Paged---------205340
-Peak--------591796-----Nonpaged------43328
------------------------------------------------------
Processes: 50 CPU Usage: 3% Commit Charge: 446M/10040M

(it would be nice if I could use tables and rows BBCode)

Processes tab:

Image Name---User Name-------Mem Usage---Handles--USER..-GDI..
----------------------------------------------------------------------------------
hostmon.exe---monitorcsn-----------56.800 K-----840-------0-------0
explorer.exe---monitorcsn-----------20.868 K-----391-------0-------0
svchost.exe----SYSTEM---------------20.484 K--1.271-------0-------0
explorer.exe---OBroinP---------------16.592 K----338-----112----207
w3wp.exe------NETWORK SERVICE--14.188 K---276-------0-------0
lsass.exe-------SYSTEM---------------11.404 K----633-------0-------0
inetinfo.exe----SYSTEM-----------------9.904 K----250-------0-------0
svchost.exe----SYSTEM-----------------8.584 K----165-------0-------0
TmListen.exe---SYSTEM----------------8.380 K----232-------0-------0
svchost.exe----SYSTEM-----------------5.932 K----229-------0-------0
wmiprvse.exe--SYSTEM----------------5.872 K-----158-------0-------0
csrss.exe--------SYSTEM---------------5.844 K------664-------0-------0
webservice.exe-SYSTEM---------------5.412 K------71-------0-------0
msdtc.exe-------NETWORK SERVICE--4.912 K----159-------0-------0
PccNTMon.exe--OBroinP----------------4.788 K----148-------0-------0
svchost.exe-----SYSTEM----------------4.656 K----231-------0-------0
ctfmon.exe------monitorcsn------------4.492 K------70-------0-------0

Will that do?
In Event Viewer, I haven't seen anything in System or Security Logs and in Application only what I've told you already.
Regards,
P.

KS-Soft Europe · Post by **KS-Soft Europe** » Wed Dec 13, 2006 10:22 am

monitorcsn001 wrote:-Handles----11050----Total------------8386680

Hm. So many handles. I suppose, amount of handles have been increasing? Windows 2000 works unstable when total handle usage is about 12,000. Windows 2003 works a little better and can handle about 15-17 thousand handles. But system behavior is unpredictable when this limit is reached.

monitorcsn001 wrote:hostmon.exe---monitorcsn-----------56.800 K-----840-------0-------0

Hostmon.exe process does not use any USER and GDI objects? It is impossible! What process uses the most of handles? I am unable to find out this information from the foregoing table.

monitorcsn001 wrote:In Event Viewer, I haven't seen anything in System or Security Logs and in Application only what I've told you already.

Very strange behavior.

Could you send all *.ini, *.lst and *.hml files to support@ks-soft.net?

Regards,
Max Peters
www.ks-soft.net

monitorcsn001 · Post by **monitorcsn001** » Thu Dec 14, 2006 5:17 am

KS-Soft Europe wrote:What process uses the most of handles?

This morning hostmon.exe has just over 1.900 handles, with svchost.exe second at around 1.270.
On the table I sent you from yesterday's snapshot, hostmon got second place.

KS-Soft Europe wrote:Very strange behavior.

If you say so.
I also looked at task manager and the only User and GDI objects used are those processes initiated my logon (OBroinP) - taskmgr, explorer, etc. and also winlogon.exe (SYSTEM).

KS-Soft Europe wrote:Could you send all *.ini, *.lst and *.hml files to support@ks-soft.net?

Done.

KS-Soft Europe · Post by **KS-Soft Europe** » Thu Dec 14, 2006 6:23 am

monitorcsn001 wrote:hostmon.exe---monitorcsn-----------56.800 K-----840-------0-------0

This situation means, that HostMonitor servise is started with disabled "Allow service to interact with desktop" option in standard windows "Services" applet. We recommend to enable "Local system account" and "Allow service to interact with desktop" options in "Services" applet for the HostMonitor service. If you need to start service under certain account (e.g. admin account), you may assign a special user account on the Service page in the Options dialog (menu Options > Service tab). In this case HostMonitor will impersonate the security context of the user and will be able to interact with desktop.

monitorcsn001 wrote:This morning hostmon.exe has just over 1.900 handles, with svchost.exe second at around 1.270

So, looks like handles leakage in HostMonitor. Could you try to disable ODBC logging for couple of hours and watch for handles changes?

Regards,
Max

monitorcsn001 · Post by **monitorcsn001** » Fri Dec 15, 2006 3:34 am

Image Name User Name CPU Mem Usage Threads GDI Objects

KS-Soft Europe wrote:This situation means, that HostMonitor ...

Oops! Sorry, I just realised what the misunderstanding is over.

HostMonitor is started as an Application with a local and domain account.

So this time I remotely connected to the server with that account (which is always logged on). So now I have a proper snap-shot of task manager...

Image Name--User Name---CPU--Mem Usage--Handles-USER ..-GDI Obj..
-----------------------------------------------------------------------------------
hostmon.exe...monitorcsn.....02......33.112 K.....2.141.......192........237
svchost.exe.....SYSTEM..........00......20.528 K.....1.251..........2............5
explorer.exe.....monitorcsn....00.......20.084 K.......392.......129........240

I've emailed the jpg to you of the other running proccesses in the task manager window.

KS-Soft Europe · Post by **KS-Soft Europe** » Tue Dec 19, 2006 4:11 am

Sorry, I am unable to reproduce the problem. What about TrendMicro Antivirus? Have you tried to disable them?

Could you try to disable ODBC logging? What exact version of ODBC driver do you use?
Did you try to disable alerts? No changes?

Regards,
Max

KS-Soft · Post by **KS-Soft** » Thu Dec 21, 2006 4:49 pm

We have received mail from another customer with the same problem. Problem was fixed by disabling TrendMicro real-time protection.

It looks like most of real-time antivirus protection modules lead to problems, not only with HostMonitor but with various software.
We know about Norton Antivirus, McAfee. Now we added TrendMicro to the same "black" list.
AVP real-time protection does not lead to problems with HostMonitor (as far as we know) but it leads to problems with other software (e.g. we cannot burn CDs while AVP is running).
Real-time protection modules change systems behavior and not always do that correctly.
At the same time file scanner modules works without any problems.

Regards
Alex