05-26-2010 10:36 PM - edited 03-09-2019 10:59 PM
After update from 6.0.1 to 6.0.2 some systems with CSA cun`t boot.
If manualy delete agent (in safe mode) - everething ok.
Few systems butable, but agent process takes more then 90% processor resourses.
Logs on CSA MC are clean
Any ideas? Manual uninstall agent on few hungreds workstaitions is unreal...
Solved! Go to Solution.
05-27-2010 05:33 AM
There has been a recent bug discovered with interaction of CSA and Windows 7 hosts where a file access control rule which implements digital suignature checking can cause a system to "hang" after entering credentials. The bug is CSCtg98849. The following workaround is provided in the bug:
Edit the "Base - Digital Signing of Downloaded Executables" rule module and disable the file access control "Send downloaded executables for scanning if opened for read".
Save the change.
Generate rules and deploy to affected hosts.
There has also been an issue seen where agents that have not received the new 6.0.2 binaries, but have had 6.0.2 rules pushed encounter issues. The workaround in this instance is to schedule an update for the agents.
It would be advatageous to open a service request with TAC to effectively diagnose the issue, and ensure this is the proper bug for the behavior.
Scott
What | How Bad | Who | Versions | ||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|
|
|
History |
---|
Histogram of CSCtg98849: Covering 2 days and counting, currently in A-Assigned state. N -> A [ 0] | <-----------------------------------+-----------------------------------> |
cdreier | 05/26/2010 09:52:05 | Headline: | CSA: Windows Login Hangs or Takes Excessive Time with CSA Enabled --> CSA: Windows 7 Login Hangs or Takes Excessive Time with CSA Enabled |
cdetsbsi | 05/25/2010 10:08:31 | Trouble-Tickets: | --> 614262487 |
pgiang | 05/25/2010 06:35:29 | Assigner: | --> pgiang |
pgiang | 05/25/2010 06:35:29 | Assigned Date: | --> 05/25/2010 09:35:29 |
pgiang | 05/25/2010 06:35:19 | Engineer: | --> bipswain |
pgiang | 05/25/2010 06:35:01 | Status: | N --> A |
pgiang | 05/25/2010 06:35:29 | To-be-fixed: | --> 006.000(002) |
cdetsbsi | 05/25/2010 06:29:31 | Trouble-Tickets: | --> 614327539 |
cdetsbsi | 05/25/2010 06:29:31 | Urgency-desc: | NA --> P3 |
scfringe | 05/25/2010 06:26:54 | Note Title: | --> Release-note |
scfringe | 05/25/2010 06:14:01 | Summary: | --> |
scfringe | 05/25/2010 06:13:20 | RNE-Approval-Flg: | N --> |
scfringe | 05/25/2010 06:13:20 | Note Title: | --> SS-Review |
scfringe | 05/25/2010 06:12:14 | Defect Created: | --> |
05-27-2010 05:33 AM
There has been a recent bug discovered with interaction of CSA and Windows 7 hosts where a file access control rule which implements digital suignature checking can cause a system to "hang" after entering credentials. The bug is CSCtg98849. The following workaround is provided in the bug:
Edit the "Base - Digital Signing of Downloaded Executables" rule module and disable the file access control "Send downloaded executables for scanning if opened for read".
Save the change.
Generate rules and deploy to affected hosts.
There has also been an issue seen where agents that have not received the new 6.0.2 binaries, but have had 6.0.2 rules pushed encounter issues. The workaround in this instance is to schedule an update for the agents.
It would be advatageous to open a service request with TAC to effectively diagnose the issue, and ensure this is the proper bug for the behavior.
Scott
What | How Bad | Who | Versions | ||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|
|
|
History |
---|
Histogram of CSCtg98849: Covering 2 days and counting, currently in A-Assigned state. N -> A [ 0] | <-----------------------------------+-----------------------------------> |
cdreier | 05/26/2010 09:52:05 | Headline: | CSA: Windows Login Hangs or Takes Excessive Time with CSA Enabled --> CSA: Windows 7 Login Hangs or Takes Excessive Time with CSA Enabled |
cdetsbsi | 05/25/2010 10:08:31 | Trouble-Tickets: | --> 614262487 |
pgiang | 05/25/2010 06:35:29 | Assigner: | --> pgiang |
pgiang | 05/25/2010 06:35:29 | Assigned Date: | --> 05/25/2010 09:35:29 |
pgiang | 05/25/2010 06:35:19 | Engineer: | --> bipswain |
pgiang | 05/25/2010 06:35:01 | Status: | N --> A |
pgiang | 05/25/2010 06:35:29 | To-be-fixed: | --> 006.000(002) |
cdetsbsi | 05/25/2010 06:29:31 | Trouble-Tickets: | --> 614327539 |
cdetsbsi | 05/25/2010 06:29:31 | Urgency-desc: | NA --> P3 |
scfringe | 05/25/2010 06:26:54 | Note Title: | --> Release-note |
scfringe | 05/25/2010 06:14:01 | Summary: | --> |
scfringe | 05/25/2010 06:13:20 | RNE-Approval-Flg: | N --> |
scfringe | 05/25/2010 06:13:20 | Note Title: | --> SS-Review |
scfringe | 05/25/2010 06:12:14 | Defect Created: | --> |
05-27-2010 06:11 AM
Symptoms are same, but our problem on Windows XP.
Rules were edited as recommended, waiting...
11-18-2010 06:15 PM
Scott
I have same issue with CSA 6.0.2.126 on Windows Vista x86 Enterprise.
In kernel log, I can see
.......................
csafilt: InitFilters: FwpmEngineOpen0 failed with 0xc0020035
csafilt: InitFilters: FwpmEngineOpen0 failed with 0xc0020036
csafilt: StateChangeCallback: Couldn't initialize filters (start pending)
.......................
And, there are big delay(about 50 minutes) between the first and second message.
I'm using CSA 6.0.2.126 for development, so it is not managed client.
So, can't apply your work around.
Is there workaround to avoid this issue in client side?
And, any plan to fix this issue?
Thanks in advance.
11-19-2010 03:36 AM
This does not sound like the same issue. It would be best to open a service request with TAC specific to the Cisco product for which the unmanaged CSAgent was provided (not for CSA itself). This will ensure the team that was responsible for creating that unmanaged agent can troubleshoot directly.
Scott
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide