Menu
▾
▴
#29 Snare crashes on Win 2008 Domain Controller
Hello,
I've Snare running on several Windows 2008 Domain Controllers. Snare captures all of Windows’ Event Log Data, converts it into the SYSLOG format and sends it to our central SYSLOG server. On some of the systems Snare crashes with the message which is included in the attached file “Snare Error.txt”. The description that belongs to the exception code, according to a web site, is “An invalid parameter was passed to a C runtime function”. Additionally the message “The SNARE service terminated unexpectedly. It has done this 4 time(s).” appears in the system log.
Noticeable is, that the amount of log data is very high (about 8 GB within one day) on the systems that crash. On systems which are not as utilized as the aforementioned (about 30 MB within one day) Snare is running stable.
I'm thankful for any help. If further information is needed, don't hesitate to contact me via e-mail.
Thanks in advance!
Error Message
Thanks for the information, I'll start looking into this bug as soon as I can. I'm interested to track down if this is a load problem or a specific message that is causing the fault. Is the agent crashing at certain times of day?
Regards, David.
Thanks for the information, I'll start looking into this bug as soon as I can. I'm interested to track down if this is a load problem or a specific message that is causing the fault. Is the agent crashing at certain times of day?
Regards, David.
Hello David,
Thank you for your reply. No, the crashes are not associated with a certain time. It happens all over the day, even sometimes immediately after a restart.
In the meantime a second phenomenon has occurred. SNARE sometimes stops sending messages to the SYLOG Server, even though the service is running. In this case there is neither an entry in the Application Log, nor in the System Log. I’d exclude that this interruption is caused by the SYSLOG Server, because he received messages from the affected server before the interruption occurred and still receives messages from other SNARE Agents after it. Unfortunately is this error not reproducible.
Regards,
Thomas
Hi Thomas,
I've prepared a new version of the Windows 2008 (Vista) agent with a number of bug fixes. I'll leave the ticket open for now in case this particular problem has not been addressed. The new release should be available next week.
Regards, David.