IV16283: UA ON WINDOWS: SCRIPT DATAPROVIDER MAY TERMINATE O/S PROCESS

IBM Tivoli Monitoring 6.2.2 Fix Pack 9 (6.2.2-TIV-ITM-FP0009)

APAR status

• Closed as program error.

Error description

• Severity: 2
  Approver: BEH
  Compid:   5724K1000 Tivoli Universal Agent
  Abstract: UA on Windows: Script DataProvider may terminate O/S
  process
  
  Environment:
  This problem was reported for Universal Agent on Windows 2008
  
  Problem Description:
  UA SCRIPT Data Provider has logic to check for a whether a
  launched script process has not completed within its alloted
  time, 60 sec by default or per RUNTIME setting in metafile.
  Before UA terminates the script process it iterates thru any
  child processes spawned by the Script process.  Due to some
  unknown Microsoft defect in CreateToolHelp32Snapshot() API on
  very rare occasion the data returned indicates the O/S binary
  CSRSS.exe as being a child process of customer's Script
  processed, UA terminates this CSRRS.exe, as it does any child
  process, and then customer encounters BSOD.
  
  Detailed Recreation Procedure:
  Not recreateable; problem has occurred only in Windows 2008 at
  customer installation.
  
  Related Files and Output:
  This problem cannot be determined by trace log.
  

Local fix

• This problem can occur when a launched script process has not
  completed within its alloted time, 60 sec by default or per
  RUNTIME setting in metafile.
  If you can guarantee the script finishes within its alloted
  time, this problem will not occur.
  

Problem summary

• On Windows, the Universal Agent script data provider may
  terminate an unrelated process.
  
  
  This is a rare and random condition of the Universal Agent
  script data provider that has only been seen on Windows 2008 to
  date. In this case, the user's script was running frequently
  throughout the day, and the process CSRSS.EXE had been
  terminated only once during the year.
  

Problem conclusion

• For reasons unknown, Microsoft's process API
  CreateToolhelp32Snapshot may return an incorrect parent process
  ID on a very rare occasion. Various forums on the Web indicate
  it is highly improbable that Microsoft will address this flaw.
  
  It is this incorrect parent process ID that causes Universal
  Agent to mistakenly terminate an unrelated process such as
  CSRSS.EXE. In this user's case, the process was related to
  critical OS processing, and the effect of terminating CSRSS.EXE
  crashed the Windows OS.
  
  This issue has been mitigated by providing additional process
  checks before a process is terminated.
  
  The fix for this APAR is contained in the following maintenance
  packages:
    | fix pack | 6.2.2-TIV-ITM-FP0009
    | fix pack | 6.2.3-TIV-ITM-FP0002
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  UNIVERSAL AGENT

• Fixed component ID

  5724K1000

Applicable component levels

• R622 PSY

     UP