I have a Windows 2003 server that was rebooted this am and after this hostmonitor started sending out alerts that a process check was failing - returning status 'unknown'. I went in and tried to build a new process test. When I try to select the process in the pull down menu, there is a message 'cannot retrieve process list'. I have a ping test that is working out fine. Also the process is alive and well on that machine. Why would something like this occur ? Is there a necessary service needed on the target machine ? Any advice ?
Anthony
Check Process test is failing
-
KS-Soft Europe
- Posts: 2832
- Joined: Tue May 16, 2006 4:41 am
- Contact:
Could you provide more information, please?
- What version of HostMonitor do you use?
- Is HostMonitor started as a service or as an application?
- Do you have installed antivirus monitor? Personal firewall? Content monitoring software? Non-standard winsock components? Network packet analyzer?
- What exact error do you see in "Reply" field?
- What account do you use to start HostMonitor? We recommend to start HostMonitor under admins account.
- Have you specified any account into "Connect as" boxes in "Test Properties" window?
Please make sure:
1. RPC service is started on target system
2. Remote Registry service is started on target system
3. perfProc.DLL should be enabled on target system
4. Check if "admin" account has KEY_READ access to the following registry key on target system: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows_NT\CurrentVersion\Perflib.
To view/change permissions to the registry key you can use the registry editor utility (Regedt32.exe).
5. no firewall between 2 system blocks TCP ports above 1024
Regards,
Max
- What version of HostMonitor do you use?
- Is HostMonitor started as a service or as an application?
- Do you have installed antivirus monitor? Personal firewall? Content monitoring software? Non-standard winsock components? Network packet analyzer?
- What exact error do you see in "Reply" field?
- What account do you use to start HostMonitor? We recommend to start HostMonitor under admins account.
- Have you specified any account into "Connect as" boxes in "Test Properties" window?
Please make sure:
1. RPC service is started on target system
2. Remote Registry service is started on target system
3. perfProc.DLL should be enabled on target system
4. Check if "admin" account has KEY_READ access to the following registry key on target system: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows_NT\CurrentVersion\Perflib.
To view/change permissions to the registry key you can use the registry editor utility (Regedt32.exe).
5. no firewall between 2 system blocks TCP ports above 1024
Regards,
Max
-
adzikiewicz@ccri.edu
- Posts: 6
- Joined: Thu Feb 05, 2009 10:08 am
Could you provide more information, please?
- What version of HostMonitor do you use?
7.78
- Is HostMonitor started as a service or as an application?
service
- Do you have installed antivirus monitor? Personal firewall? Content monitoring software? Non-standard winsock components? Network packet analyzer?
Antivirus, but its always been there. wireshark is there only when we need it. That is on the target machine. hostmonitor is running on windows 2003 server standard as a virtual machine on VMWare Server. It does not have anything installed as far as firewall and anti-virus.
- What exact error do you see in "Reply" field?
is blank
- What account do you use to start HostMonitor? We recommend to start HostMonitor under admins account.
administrator on the local machine
- Have you specified any account into "Connect as" boxes in "Test Properties" window?
The configuration manager has the credentials for a domain admin
Please make sure:
1. RPC service is started on target system
it is running
2. Remote Registry service is started on target system
it is running, I restarted and re-executed the test - still no luck
3. perfProc.DLL should be enabled on target system
4. Check if "admin" account has KEY_READ access to the following registry key on target system: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows_NT\CurrentVersion\Perflib.
To view/change permissions to the registry key you can use the registry editor utility (Regedt32.exe).
This should have been all set. I did change this on the target machine so that the credentials in the connection manager have read access. This hasnt changed. So my guess is that it was implied when it was working before.
I made this change and re-executed the test an d still nothing
5. no firewall between 2 system blocks TCP ports above 1024
There is nothing going on there
- What version of HostMonitor do you use?
7.78
- Is HostMonitor started as a service or as an application?
service
- Do you have installed antivirus monitor? Personal firewall? Content monitoring software? Non-standard winsock components? Network packet analyzer?
Antivirus, but its always been there. wireshark is there only when we need it. That is on the target machine. hostmonitor is running on windows 2003 server standard as a virtual machine on VMWare Server. It does not have anything installed as far as firewall and anti-virus.
- What exact error do you see in "Reply" field?
is blank
- What account do you use to start HostMonitor? We recommend to start HostMonitor under admins account.
administrator on the local machine
- Have you specified any account into "Connect as" boxes in "Test Properties" window?
The configuration manager has the credentials for a domain admin
Please make sure:
1. RPC service is started on target system
it is running
2. Remote Registry service is started on target system
it is running, I restarted and re-executed the test - still no luck
3. perfProc.DLL should be enabled on target system
4. Check if "admin" account has KEY_READ access to the following registry key on target system: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows_NT\CurrentVersion\Perflib.
To view/change permissions to the registry key you can use the registry editor utility (Regedt32.exe).
This should have been all set. I did change this on the target machine so that the credentials in the connection manager have read access. This hasnt changed. So my guess is that it was implied when it was working before.
I made this change and re-executed the test an d still nothing
5. no firewall between 2 system blocks TCP ports above 1024
There is nothing going on there
By the description 'rebooted this am' one might assume that this server received some M$ Automatic Updates that forced the restart. If one of the received updates was a security update any of the things mentioned could be the case - especially pay attention to firewall settings, they sometimes change without notice. 
If this is the case I would advise disabling Automatic Updates on your critical systems and set up a maintanence schedule and better controls for applying these updates.
A quick fix - If you have System Restore enabled you could 'roll back' to a previous restore point and validate that the process check works. You need to be careful with this option, but if it works you can then walk through each update manually - of course once you've identified the impact of each one.
If this is the case I would advise disabling Automatic Updates on your critical systems and set up a maintanence schedule and better controls for applying these updates.
A quick fix - If you have System Restore enabled you could 'roll back' to a previous restore point and validate that the process check works. You need to be careful with this option, but if it works you can then walk through each update manually - of course once you've identified the impact of each one.
I would recommend to setup CPU Usage test for the same target system. CPU Usage and Process tests utilize similar code and require the same services and permissions while CPU Usage test provides a little better diagnostic information. You should see error description in Reply field of the test
Regards
Alex
Regards
Alex
Alex,
I use a combination of the two - a 'master test' of CPU utilization to let me know when a general 'spike' occurs, and a 'dependant test' of dominant process to let me know the prime suspect.
But I frequently loose data because (I think I've stated this before) dependant test(s) don't launch immediately when a master test reaches alert status, and instead wait for the next test cycle. If the relationship is that the dependant run until master changes status that's OK, but if the dependant test is 'in waiting' that is much too passive an approach for my taste.
A workaround - your thoughts. . .
If this works it would definitely be do-able for one-to-one master/dependant pairs, but become ugly with many-to-one sets.
Maybe I could I attach an HMS script using RefreshTest <testname> to an alert action on the Master.
Would that work?
Can I expect a change in the master/dependant properties that would allow dependant tests to be immediately launched?
I use a combination of the two - a 'master test' of CPU utilization to let me know when a general 'spike' occurs, and a 'dependant test' of dominant process to let me know the prime suspect.
But I frequently loose data because (I think I've stated this before) dependant test(s) don't launch immediately when a master test reaches alert status, and instead wait for the next test cycle. If the relationship is that the dependant run until master changes status that's OK, but if the dependant test is 'in waiting' that is much too passive an approach for my taste.
A workaround - your thoughts. . .
If this works it would definitely be do-able for one-to-one master/dependant pairs, but become ugly with many-to-one sets.
Maybe I could I attach an HMS script using RefreshTest <testname> to an alert action on the Master.
Would that work?
Can I expect a change in the master/dependant properties that would allow dependant tests to be immediately launched?
greyhat64,
1) Please use different topic. This topic is related to problem experienced by adzikiewicz@ccri.edu
It has nothing to do with master-dependant relations.
2) You asked for "Recheck dependant test items when master test status has been changed" option. As I remember you said you need this option for tests that depend on expression. We implemented this option. Why you don't want to use it? I think its just what you need? If I am wrong please start new thread or use old one... probably this one: http://www.ks-soft.net/cgi-bin/phpBB/vi ... php?t=4771
Regards
Alex
1) Please use different topic. This topic is related to problem experienced by adzikiewicz@ccri.edu
It has nothing to do with master-dependant relations.
2) You asked for "Recheck dependant test items when master test status has been changed" option. As I remember you said you need this option for tests that depend on expression. We implemented this option. Why you don't want to use it? I think its just what you need? If I am wrong please start new thread or use old one... probably this one: http://www.ks-soft.net/cgi-bin/phpBB/vi ... php?t=4771
Regards
Alex
-
adzikiewicz@ccri.edu
- Posts: 6
- Joined: Thu Feb 05, 2009 10:08 am
-
adzikiewicz@ccri.edu
- Posts: 6
- Joined: Thu Feb 05, 2009 10:08 am
- Server is started, network is up (ping test works)
- no firewall between systems
- RPC service started
- Remote Registry Service started
Right?
H'm...
We cannot find anything else at microsoft.com, they say just about valid IP address and started Remote Registry Service
Can HostMonitor check other systems within the same target domain using CPU Usage or Process test methods?
Can it check the system using Service test method? Service test method requires RPC service as well, so it uses the same TCP ports but it does not need Remote Registry Service and admin rights.
May be you just need to try "magic" trick - reboot the system once more?
Regards
Alex
- no firewall between systems
- RPC service started
- Remote Registry Service started
Right?
H'm...
We cannot find anything else at microsoft.com, they say just about valid IP address and started Remote Registry Service
Can HostMonitor check other systems within the same target domain using CPU Usage or Process test methods?
Can it check the system using Service test method? Service test method requires RPC service as well, so it uses the same TCP ports but it does not need Remote Registry Service and admin rights.
May be you just need to try "magic" trick - reboot the system once more?
Regards
Alex