CSAuth stops repeatedly

[STEPAN JANKOVIC]

Hi,

we have problem with ACS 3.2(Win2k):

2 days before, ACS starts logging messages "Service CSAuth has been stopped or paused by the system". Occurence is random and frequent. No changes on system done. Any ideas?

Thanks for help

Stepan

03/24/2005,17:27:24,Service CSAuth has been stopped or paused by the system. Monitoring will suspend until the service is restarted. ,578,13932,0,19,-,0,-,-,64,1276,0,3,161,2200,0,42,469,15308,0,90,46,525,9328,0,102,31,619,4534,95

03/24/2005,17:27:35,Service CSAuth has been restarted so monitoring will now continue. ,578,13932,0,19,1033,17240,1,87,64,1276,0,3,161,2200,0,42,469,15308,0,90,47,532,9328,0,102,16,618,4534,2

03/24/2005,18:50:06,Failed to log accounting packet to logger localCSLog. ,506,11432,0,17,935,17140,-,87,64,1276,0,3,148,2148,0,42,467,5388,0,90,47,246,3576,0,22,16,745,4532,5

03/24/2005,20:57:16,Service CSAuth has been stopped or paused by the system. Monitoring will suspend until the service is restarted. ,506,11432,0,17,-,0,-,-,64,1276,0,3,148,2148,0,42,467,5452,0,90,47,283,4072,0,30,31,759,4529,46

03/24/2005,20:57:28,Service CSAuth has been restarted so monitoring will now continue. ,506,11432,0,17,1026,17192,0,87,64,1276,0,3,148,2148,0,42,467,5452,0,90,47,285,4104,0,30,31,759,4529,0

03/24/2005,21:33:57,Service CSAuth has been stopped or paused by the system. Monitoring will suspend until the service is restarted. ,506,11432,0,17,-,0,-,-,64,1276,0,3,148,2148,0,42,467,5484,0,90,31,280,4404,0,30,16,760,4528,47

03/24/2005,21:34:08,Service CSAuth has been restarted so monitoring will now continue. ,506,11432,0,17,1012,17200,0,87,64,1276,0,3,148,2148,0,42,467,5484,0,90,31,277,4404,0,30,16,759,4528,0

03/24/2005,22:00:56,Service CSAuth has been stopped or paused by the system. Monitoring will suspend until the service is restarted. ,506,11432,0,17,-,0,-,-,64,1276,0,3,150,2148,0,42,465,5516,0,90,47,275,4288,0,30,15,760,4528,97

03/24/2005,22:01:07,Service CSAuth has been restarted so monitoring will now continue. ,506,11432,0,17,1022,17216,0,87,64,1276,0,3,150,2164,0,42,465,5516,0,90,47,277,4288,0,30,15,759,4528,1

03/24/2005,22:35:43,Auth server down: Could not change Password. ,506,11432,0,17,-,0,-,-,64,1276,0,3,150,2164,0,42,468,5548,0,90,31,276,4228,0,30,3281,759,4528,82

03/24/2005,22:36:33,Service CSAuth has been stopped or paused by the system. Monitoring will suspend until the service is restarted. ,506,11432,0,17,-,0,-,-,64,1276,0,3,152,2164,0,42,468,5548,0,90,31,281,4552,0,30,3281,759,4528,95

[umedryk]

The messages that you see are informational. This could happen due to one of the following:

csreplication between master & slave

csbackup of database

csdbsync or net stop csauth

Check to se if any of these features are enabled on the system. If that is the case then it is normal behaviour. Hope this helps.

[anthonyhoar]

Symantec Antivirus Signature Updates were causing our CSAuth service to Stop and Start Unexpectedly.

Cisco TAC showed me the following:

By creating a Package.cab file and looking at the AppEventDump.txt file you can see the correlation between the AV update and the CSAuth service stopping.

[STEPAN JANKOVIC]

Hello,

my issue was caused by failing aux connection from one switch to another, which was causing a huge amount of unsuccessful login attempts, so ACS was overloaded.

Thanks for your interest

Regards

Stepan