Hostmonitor 5.38 doesn´t send notifications anymore

[DKammler]

The latest version of Hostmonitor very often stops sending e-mail and other notificitions. At the time the notification stops the eventlog (application) is full of "access violations", e.g. "access violation at address 7C9596D0 in module 'ntdll.dll'. Read of address 00000014".The tests, by the way, seem to work further on.
Restarting the service does not help, only a complete reboot of the server will solve this roblem for some hours resp. some days. We never encountered such or a similar problem with any Hostmonitor version before!

We run Hostmonitor on a 2003-System with SP1.

Any ideas?

[KS-Soft]

Do you have some antivirus monitor or personal firewall installed on the system? Especially Norton Antivirus or McAfee that often couse troubles?

Regards
Alex

[DKammler]

Hi Alex,

sorry, but we don´t use a personal firewall or any antivirus software on our monitoring system.

Regards,
Dietmar

[adrianjuk]

Yes we have exactly the same issue. Sems to be intermittent and could be connected to checking Windows services on remote servers but I can't be certain

[KS-Soft]

[adrianjuk]

Hi

Yes we were using them but I have had to turn them off. However, we have another Hostmonitor LITE installation that has happily been running at least one ODBC test for some months now. The LITE version is V4.8.

I will be able to update you when I turn the ODBC tests back on again. All of the ODBC tests are using Oracle V9r2 ODBC drivers and not the Microsoft ones

Incidentally, we use Symmantec V9 Antivirus

[KS-Soft]

[DKammler]

We have no ODBC tests running, we only check for existence of the SQL Server service.
In the last three days HostMonitor "crashed" (stopped sending messages) approximately every 24 to 36 hours.
Im not amused to start HostMonitor from my my home this weekend, but the tests we make are essential.
HostMonitor *IS* the source of the error message: See the complete attached error message (sorry, but it is predominantly in German; "Ereignisquelle" stands for "source"). After the first error message of this type (some other follow), HostMonitor becomes "very silent".

Ereignistyp: Fehler
Ereignisquelle: hostmon.exe
Ereigniskategorie: Keine
Ereigniskennung: 0
Datum: 19.08.2005
Zeit: 00:19:15
Benutzer: Nicht zutreffend
Computer:
Beschreibung:
Die Beschreibung der Ereigniskennung ( 0 ) in ( hostmon.exe ) wurde nicht gefunden. Der lokale Computer verfügt nicht über die zum Anzeigen der Meldungen von einem Remotecomputer erforderlichen Registrierungsinformationen oder DLL-Meldungsdateien. Möglicherweise müssen Sie das Flag /AUXSOURCE= zum Ermitteln der Beschreibung verwenden. Weitere Informationen stehen in Hilfe und Support. Ereignisinformationen: Access violation at address 7C9596D0 in module 'ntdll.dll'. Read of address 00000014.


Regards,
Dietmar

[KS-Soft]

Unfortunately error appears outside of HostMonitor's code (ntdll.dll), that's why we cannot investigate that problem
BTW: What kind of actions do you use? If HostMonitor stops sending e-mail, could you try to add some another alert, e.g. show message on screen? Does it work?

[KS-Soft]

PS Could you checked system log (log that is specified on Advanced Logs page in the Options dialog)? Any error messages there?

[DKammler]

Hi Alex,

thank you very much for your hint, shame over me, that I didn´t have a look at the system log first! Here are, I think, the errors related to my problem. An excerpt is following, the second error continues endlessly until reboot of the server.

20/08/2005 22:17:09 SMTP client error: Error reading CancelBtn.Kind: Canvas does not allow drawing
20/08/2005 22:17:41 SMTP client error: Access violation at address 00421A11 in module 'hostmon.exe'. Read of address 6C502031

Regards,
Dietmar

[KS-Soft]

Interesting. Now I know where error happens but I don't know why it happens. Error occurs when HostMonitor creates SendMail dialog. Windows does not provide access to bitmap resource...
Theoretically it could happen when Windows is out of resources (GDI objects).

You said you need to restart system to fix the problem? Most likelly there is resource leakage in some application. Could you check what applications uses the most of Handles, GDI and User objects (after error occurs). You may use standard Windows Task Manager

Regards
Alex

[DKammler]

This afternoon Hostmonitor crashed completely with following exception:

c00000fd at address 7C933FD7 (ntdll!mbstowcs)

Regarding to the hint in your last reply I had a look at the number of handles and GDI objects used by Hostmonitor. Two hours before the crash Hostmonitor had used over 9000 (nine thousand) GDI objects!

Sorry, but I was not able to open the syslog.htm this time: the filesize had reached 37 MB and IE timed out. I renamed syslog.htm to syslog.old, Hostmonitor created an new one, so I will catch the error next time.

Regards,
Dietmar

[KS-Soft]

9000?!
Could you send your settings for testing? We need HML file, all *.LST and *.INI files

Regards
Alex

[KS-Soft]

BTW
We still believe there is some error in some system DLL. If there is resource leakage in HostMonitor's code, Windows would release all resources used by HostMonitor when you restart HostMonitor (simply stop and start service). But it does not help, right?

Could you try to install HostMonitor on different system? As usually we recommend Windows 2000 SP4

Regards
Alex