Cisco TS Agent for Sourcefire version 1.1 and 1.2 likely cause TerminalServer to freeze disconnect users no login permitted

[jamie.bush@vgreed.com]

For three months I have had issues with a production terminal server (2012 release two) for a 65 user profile install.  The terminal server disconnects users and does not permit login to the console nor via the network until the Virtual Machine is rebooted via a power reset.  A replacement terminal server occurred with the same software installed on the previous terminal server with the exception of antivirus software. The replacement server did not have antivirus software installed. One believes that the Cisco TS Agent is the issue because the freeze/disconnect/failure did not occur for the first two weeks use of the replacement server as it was not installed. Then once, the TS Agent was installed the freeze/lockout/disconnect until power reset event occurs.  Usually the event occurs around or after lunchtime. The app by default (TS agent) recommends 29 users but support says that more users are supported. One does not know which is correct--- =<29 or =<100.  Of note is that when the event occurs, no logging under event viewer -> Application and Services Logs-> Terminal Services Agent Log shows for about ten to 15 minutes.  To be clearer, the event is recognized at 113 pm by high CPU in virtualization monitoring and users cannot connect and lose connections. However, no events are logged between 101 pm and 115 pm and 115 pm is when the server is rebooted.  This last bit of information is useful because all users should be surfing and working using web based email at those time period yet the TS Agent logs nothing even with debug mode at level 6.

[greenwire]

We also appear to be experiencing this issue.

We have a client where we recently implemented a 5508-X and FPMC. They are running Windows Server 2016 RDS servers on VMWare. Prior to installing TS Agent there were no lockup issues with the servers. After installing TS Agent, at random intervals, we see the virtual machines spike CPU utilization and plateau at max. They become inaccessible via the network or via the console. They require a power off / power on to get back up and running. No events are logged in event log other than the improper shutdown. During the lockup times the event log has zero errors.

What we've tried for troubleshooting:

1. Moved the virtual machines to new host hardware. This did not resolve the issue.

2. Moved the virtual machines to a host with a newer version of ESXi. This did not resolve the issue.

3. Upgraded the VMWare Tools software on the virtual machine. This did not resolve the issue.

4. Rebuilt the virtual machine config file as a new virtual machine, and then attached the virtual hard drive to the new config. This did not resolve the issue.

5. Opened a ticket with VMWare to see if it was a VMWare issue. They do not believe it is an issue on their end. They've reviewed logs from all hosts and the virtual machines.

6. Had users eliminate different pieces of software from daily use, to rule out a software issue. This did not resolve the issue.

7. Tried assigning additional resources to the virtual machine. This did not resolve the issue.

8. Moved the virtual machine from SAN storage to local storage. This did not resolve the issue.

9. Uninstalled TS Agent and had users test. No lockups. 

10. Reinstalled TS Agent and had users test. Lockups returned within 24 hours.

We will be opening a support ticket with Cisco today.

[felipe.goulart@infrati.com.br]

Dear, we are facing same issue here, any updates from your side?

Ty.

[jamie.bush@vgreed.com]

Felipe,

I am told that 1.3 is available.  This associate at Cisco wants me to install 1.3 and I'm afraid I would rather others test it. punegarg@cisco.com The 1.1 and 1.2 took down my 2012r2 terminal server so many times that I carried a notebook with me while going to the grocery/kidsSports/wherever.  I sure would love to know if 1.3 indeed works as promised but I do not want to be a guinea pig anymore.  Please share the result of trying 1.3.-Jamie

[felipe.goulart@infrati.com.br]

Thank you guys, maybe it is related to this bug (https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvp10012). I will try to convence customer to use this. Officially only version 1.3 supports Server 2012 R2.

[greenwire]

TS Agent 1.3 did fix our issues. We've had it deployed for about a month now and no crashes or issues. I would highly recommend giving it a try.

[felipe.goulart@infrati.com.br]

Wich vmware version are you running?

Ty.

[greenwire]

We are using VMWare 6.7. We've had zero issues with TS Agent 1.3.

[felipe.goulart@infrati.com.br]

Nice, thanks a lot!!!