Watchdog stopping the Windows OS agent unexpectedly
Albook 120000625S Visits (5957)
Most of the defects that caused unexpected behaviors of the Watchdog component have been already addressed many years ago.
There are anyway some scenarios where the Watchdog code is not directly responsible of problems with service management.
In this blog article, I will describe a scenario where a Windows OS Agent on a server was stopped by the Watchdog and not restarted, thus causing an unplanned outage of the monitoring service.
ITM watchdog feature uses two scripts, getstat.vbs and getinstances.vbs, to retrieve the status of the monitored processes.
In this scenario, we observed that from time to time, getstat.vbs failed and exited with < -1073741819 >
The logs showed a message sequence like:
In this case, the watchdog stops the monitored process and does not restart it, causing an unexpected outage.
The negative return code -1073741819 is actually the translation of 0xC0000005.
From previous experiences, we know that this kind of of problem can be caused by an AntiVirus software running on the machine, it occurred often with McAfee antivirus.
If McAfee antivirus is installed, the problem is most likely caused by the SCRIPTSN.dll, which is delivered with McAfee Version 8.8 (this dll is responsible for the script virus scan) even if the ScriptScan component is disabled.
The problem occurs on Windows 2008 R2 and McAfee 8.8.
The McAfee technote above describes two possible workarounds:
1) Enable the ScriptScan
- Open a command prompt windows
- Change to the right directory:
64 bit computers:
- To completely disable the scriptscan dll, type the command below and press
In our environment we unregistered SCRIPTSN.dll and problem was solved.
Hope it helps
Subscribe and follow us for all the latest information directly on your social feeds: