AshishP asked a question.
Hi Folks,
Is anyone facing issues with the Snow Inventory Agent service? Observed that the Snow Inventory Agent service stops automatically after upgrading to the latest version (6.8.1). Can you please advise what can we do in this scenario?
Is there anything being reporting in the snowagent.log file (found in C:\Program Files\Snow Software\Inventory\Agent\data)?
Or the Windows event logs?
Hi Colin @Colin Hardie​,
I found below error logs in the snowagent.log file
2021-12-15T21:29:41+05:30; ERROR; snowagent; win32\softwareinfo.cpp; CSoftwareInfo::Scan::<lambda_2b915fb9464016d8b93acc24d4596d68>::operator (); Access is denied: C:\ProgramData\Microsoft\Windows\SystemData
2021-12-15T21:29:42+05:30; ERROR; snowagent; win32\softwareinfo.cpp; CSoftwareInfo::Scan::<lambda_2b915fb9464016d8b93acc24d4596d68>::operator (); Access is denied: C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Cache
2021-12-15T21:29:42+05:30; ERROR; snowagent; win32\softwareinfo.cpp; CSoftwareInfo::Scan::<lambda_2b915fb9464016d8b93acc24d4596d68>::operator (); Access is denied: C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Cyber
2021-12-15T21:29:42+05:30; ERROR; snowagent; win32\softwareinfo.cpp; CSoftwareInfo::Scan::<lambda_2b915fb9464016d8b93acc24d4596d68>::operator (); Access is denied: C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\DataCollection
2021-12-15T21:29:42+05:30; ERROR; snowagent; win32\softwareinfo.cpp; CSoftwareInfo::Scan::<lambda_2b915fb9464016d8b93acc24d4596d68>::operator (); Access is denied: C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\DLP
2021-12-15T21:29:42+05:30; ERROR; snowagent; win32\softwareinfo.cpp; CSoftwareInfo::Scan::<lambda_2b915fb9464016d8b93acc24d4596d68>::operator (); Access is denied: C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Downloads
2021-12-15T21:29:42+05:30; ERROR; snowagent; win32\softwareinfo.cpp; CSoftwareInfo::Scan::<lambda_2b915fb9464016d8b93acc24d4596d68>::operator (); Access is denied: C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\SenseCM
2021-12-15T21:29:42+05:30; ERROR; snowagent; win32\softwareinfo.cpp; CSoftwareInfo::Scan::<lambda_2b915fb9464016d8b93acc24d4596d68>::operator (); Access is denied: C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Temp\PSScriptOutputs
2021-12-15T21:29:42+05:30; ERROR; snowagent; win32\softwareinfo.cpp; CSoftwareInfo::Scan::<lambda_2b915fb9464016d8b93acc24d4596d68>::operator (); Access is denied: C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Trace
2021-12-15T21:29:42+05:30; ERROR; snowagent; win32\softwareinfo.cpp; CSoftwareInfo::Scan::<lambda_2b915fb9464016d8b93acc24d4596d68>::operator (); Access is denied: C:\ProgramData\Packages\Microsoft.SkypeApp_kzf8qxf38zg5c\S-1-5-21-958797529-221261333-1540833222-162961\SystemAppData\Helium
2021-12-15T21:29:42+05:30; ERROR; snowagent; win32\softwareinfo.cpp; CSoftwareInfo::Scan::<lambda_2b915fb9464016d8b93acc24d4596d68>::operator (); Access is denied: C:\ProgramData\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\S-1-5-21-958797529-221261333-1540833222-162961\SystemAppData\Helium
2021-12-15T21:29:48+05:30; ERROR; snowagent; win32\softwareinfo.cpp; CSoftwareInfo::Scan::<lambda_2b915fb9464016d8b93acc24d4596d68>::operator (); Access is denied: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Configuration
Also, the service is stopping because I have added deny rule for 2 applications for testing purposes (just to clarify, it is working fine when we are on 6.7.1). The Snow Inventory agent service is working fine if I remove the deny rule. I am not sure what is wrong with this new agent.
Can you supply the snowagent.config packaged with the new agent?...sounds like it may be misconfigured.
also, what account is the Inventory Service running under, should be SYSTEM by default, and if you are manually running the agent, make sure to 'run as' Administrator.
Hi,
I'm facing the same problem. Since the installation of 6.8.1 the agent crashes on all Windows Servers.
My workaround is to set the service recovery options to restart.
Details:
Example of event :
Faulting application name: snowagent.exe, version: 6.8.1.0, time stamp: 0x61828509
Faulting module name: snowagent.exe, version: 6.8.1.0, time stamp: 0x61828509
Exception code: 0xc0000005
Fault offset: 0x00000000000e5043
Faulting process id: 0x176c
Faulting application start time: 0x01d7f6702c7f3a9d
Faulting application path: C:\Program Files\Snow Software\Inventory\Agent\snowagent.exe
Faulting module path: C:\Program Files\Snow Software\Inventory\Agent\snowagent.exe
Report Id: 43fd4594-0bca-419a-9feb-b32d3772d60c
Faulting package full name:
Faulting package-relative application ID:
Agent configuration:
<?xml version="1.0" encoding="utf-8"?>
<Configuration>
<Agent>
<SiteName>XXX</SiteName>
<ConfigName>XXX-Standard</ConfigName>
</Agent>
<Server>
<Endpoint>
<Address>http://snow.contoso.com:8088</Address>
</Endpoint>
</Server>
<!-- Delivery location for scan results -->
<DropLocation>
<Path/>
</DropLocation>
<!-- Configuration for File System scan-->
<Software>
<!-- default locations included in scan -->
<Include>
<!-- shortcuts -->
<Path recursive="1">C:\Users\*\Microsoft\Windows\Start Menu\Programs\*</Path>
<Path recursive="1">C:\Users\*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\*</Path>
<Path recursive="1">C:\ProgramData\Microsoft\Windows\Start Menu\*</Path>
<Path recursive="1">%temp%\*</Path>
<Path recursive="1">%ProgramFiles%\*</Path>
<Path recursive="1">%ProgramFiles(x86)%\*</Path>
</Include>
<!-- only files with the following extensions are included in scan -->
<IncludeCriteria>
<FileType>exe</FileType>
<FileType>wfd</FileType>
<FileType>wfi</FileType>
<FileType>wtd</FileType>
<FileType>wti</FileType>
<FileType>sys2</FileType>
<FileType>lnk</FileType>
</IncludeCriteria>
<!-- default locations that are excluded from scan -->
<Exclude>
<Path>%windir%\*</Path>
</Exclude>
</Software>
<Meter>
<Exclude>
<Path>%windir%\*</Path>
</Exclude>
<Span>
<StarTime>PT00H00M</StarTime>
<EndTime>PT23H59M</EndTime>
</Span>
<Occurance>
<Weekday>monday</Weekday>
<Weekday>tuesday</Weekday>
<Weekday>wednesday</Weekday>
<Weekday>thursday</Weekday>
<Weekday>friday</Weekday>
<Weekday>saturday</Weekday>
<Weekday>sunday</Weekday>
</Occurance>
</Meter>
<Schedule>
<Task>
<Occurance>
<AtStart>false</AtStart>
<Daily>true</Daily>
</Occurance>
<Action>scan</Action>
<TimeOfDay>PT09H00M</TimeOfDay>
<Randomize>90</Randomize>
</Task>
</Schedule>
<Logging>
<MaxSize>1024</MaxSize>
<!-- error, warning, info, trace, verbose -->
<Level>warning</Level>
</Logging>
<SystemSettings>
<Setting key="idx.endpoint" value="http://snow.contoso.com:8088/v1/Inventory.ashx" />
<Setting key="http.poll_interval" value="1200" />
<Setting key="http.poll_variance" value="300" />
<Setting key="wmi.poll_interval" value="5" />
<Setting key="send.max_scan_result_backlog_count" value="90" />
<Setting key="http.ssl_verify" value="true" />
<Setting key="env.powershell_timeout" value="300000" />
<Setting key="log.append" value="false" />
<Setting key="metering.is_enabled" value="true" />
</SystemSettings>
</Configuration>
Hey @Adam Mnich​,
Did you check with the Snow support for this issue? If yes, what they have provided as a solution to fix this issue?
I have also raised the case with Snow support but didn't receive any update on that case.
No, I haven't opened a ticket yet. First, I wanted to see here if others have the same problem.
Definitely sounds like a bug in the agent that is causing the crash. The exception code being reported, 0xc0000005, is caused by an Access Violation. Basically the agent attempting to access an invalid memory address. Think we will need to wait on Snow to resolve this. Would suggest that everyone who is encountering the same issue to raise a ticket.
For testing purposes we installed 6.8.1 on 20 Windows laptops/desktops all running W10. They all do report but we notice it takes much more time to run a scan. Even a manual "snowagent send" takes about 30 seconds! where with 6.7.2 it took 1-2 seconds... So something really changed in that 6.8.1 agent and not only the way it runs the snow scripts...
Hi @Ashish Patil​,
Did you meanwhile create a ticket and already got an answer?
We also started a rollout and I noticed stopped services. I do not know if only Windows Servers do have that problem or also Clients do have this.
But for around 460 servers I saw 20 servers that did not send current scan data within last week.
In Event Viewer there is only a message "Service terminated unexpectedly". In snowagent.log there is no message at that time.
The service termination in our case did not happen during a normal scan time, so it has perhaps to to with sending a heartbeat or softwaremetering, ...?
I just created a ticket at Snow support, 04535256
Thanks to everyone who has helped to identify the issue and for your patience whilst we worked on a solution. I wanted to highlight that on the knowledge base article it confirms the Targeted For Release version as "6.8.2":
https://community.flexera.com/s/article/snow-inventory-agent-6-8-1-service-terminated-unexpectedly The 6.8.2 release is now available. Please see our release notes for further details: https://community.flexera.com/s/article/Release-Notes-Snow-Inventory-Agent-for-Windows-6-8-2