Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 3 replies
  • Subscribers 1 subscriber
  • Views 6891 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Policy updates freezing terminal servers

chavez243

Lately it seems anytime you change a policy in SEC (5.2) and push it out to hosts, terminal servers experience freeze-ups. So far remotely running taskkill against savservice.exe releases the system, but this is a huge issue for us. We have 100s of users on terminal servers and can have them freezing up with every policy update.  

might be especially related to DLP module, but that is just a gut feeling.

:37617


This thread was automatically locked due to age.
Parents
  • 0

    during the time the system is frozen, the system event log gets lots of these entered:

    Event Type: Error Event Source: SAVOnAccessControl Event Category: None Event ID: 85 Date:  2/13/2013 Time:  11:51:03 AM User:  N/A Computer: CAWINT32 Description:  File [...irus\Security.dll]'s scan succeeded following a timeout/busy condition - it is being logged in case it contributed to that condition. Process sdcservice.exe, (start check timestamp [ 1ce0a0a4f0361cb]).

    Data: 0000: 00 00 04 00 04 00 6e 00   ......n. 0008: 00 00 00 00 55 00 3d e0   ....U.=à 0010: f7 00 4a 01 83 01 00 c0   ÷.J.ƒ..À 0018: 00 00 00 00 00 00 00 00   ........ 0020: 00 00 00 00 00 00 00 00   ........ 0028: 00 00 00 00               ....   

    Event Type: Error Event Source: SAVOnAccessControl Event Category: None Event ID: 85 Date:  2/13/2013 Time:  11:51:03 AM User:  N/A Computer: CAWINT32 Description:  File [...l\swc_service.exe]'s scan succeeded following a timeout/busy condition - it is being logged in case it contributed to that condition. Process swi_service.exe, (start check timestamp [ 1ce0a0a4eedec86]).

    Data: 0000: 00 00 04 00 04 00 6e 00   ......n. 0008: 00 00 00 00 55 00 3d e0   ....U.=à 0010: f7 00 4a 01 83 01 00 c0   ÷.J.ƒ..À 0018: 00 00 00 00 00 00 00 00   ........ 0020: 00 00 00 00 00 00 00 00   ........ 0028: 00 00 00 00               ....   

    similar for almon.exe etc....

    :37619
Reply
  • 0

    during the time the system is frozen, the system event log gets lots of these entered:

    Event Type: Error Event Source: SAVOnAccessControl Event Category: None Event ID: 85 Date:  2/13/2013 Time:  11:51:03 AM User:  N/A Computer: CAWINT32 Description:  File [...irus\Security.dll]'s scan succeeded following a timeout/busy condition - it is being logged in case it contributed to that condition. Process sdcservice.exe, (start check timestamp [ 1ce0a0a4f0361cb]).

    Data: 0000: 00 00 04 00 04 00 6e 00   ......n. 0008: 00 00 00 00 55 00 3d e0   ....U.=à 0010: f7 00 4a 01 83 01 00 c0   ÷.J.ƒ..À 0018: 00 00 00 00 00 00 00 00   ........ 0020: 00 00 00 00 00 00 00 00   ........ 0028: 00 00 00 00               ....   

    Event Type: Error Event Source: SAVOnAccessControl Event Category: None Event ID: 85 Date:  2/13/2013 Time:  11:51:03 AM User:  N/A Computer: CAWINT32 Description:  File [...l\swc_service.exe]'s scan succeeded following a timeout/busy condition - it is being logged in case it contributed to that condition. Process swi_service.exe, (start check timestamp [ 1ce0a0a4eedec86]).

    Data: 0000: 00 00 04 00 04 00 6e 00   ......n. 0008: 00 00 00 00 55 00 3d e0   ....U.=à 0010: f7 00 4a 01 83 01 00 c0   ÷.J.ƒ..À 0018: 00 00 00 00 00 00 00 00   ........ 0020: 00 00 00 00 00 00 00 00   ........ 0028: 00 00 00 00               ....   

    similar for almon.exe etc....

    :37619
Children
No Data