After upgrade, Service test for Windows Defender fails

[Alex.Gallegos]

Hello!

We have a number of service tests for critical services on our servers, one of which is Windows Defender. We recently upgraded Hostmonitor to version 15.00 and the passive RMA agent to version 8.5. The servers are running Windows Server 2019 built 17763.

After the update, the service check for the Windows Defender service (WinDefend) times out on every test. All other Service monitors - for Windows Event Log, our RMM tool, and our EDR tool, are working without issue. This service monitor was also working without issue prior to running the update last week.

I've done very little else in terms of troubleshooting since this happened as part of the update, it was working beforehand, and all other service monitors are working (while this one has failed for every server simultaneously) so I am confident it's not a fault with a single server.

I am happy to provide logs where needed, just let me know what you might need.

Thanks in advance!

[KS-Soft]

We did not change Service test for years. What version have you used before update?
Test settings?
(there are different modes and test works in different way depending on settings)
What exactly message do you see in Reply field? Timeout? "Timed out"? That's different errors.

May be you set this test using different hostname/IP format?
E.g. you set test for ServiceA using FQDN name, and set the test for WinDefend using IP?

Could you please send screen shots to support by e-mail?

Regards
Alex

[Alex.Gallegos]

Thank you Alex!

I have been digging into this in more detail on my side. It looks like this is an artifact from our old EDR solution which required manually removing Windows Defender. This test probably shouldn't be on any of our servers to begin with in our current state because the Defender service isn't present (let alone running). I would not have discovered that without Hostmonitor so it actually seems something is fixed in version 15 but I am still left wondering why this suddenly changed status after the update.

Did disabled or acknowledged tests convert back to being as part of the update to version 15, perhaps?

Does a test in a disabled state return Bad, Unknown, or Good as its state? If I check the history of this test for the last 24 months, it shows good except since the upgrade to 15.0, at which point it switches to Unknown.

[KS-Soft]

You did not answer any of my questions and did not provide screen shots. I still think this issue has nothing to do with HostMonitor update (unless previous version was not 14.96 but some much older)

Did disabled or acknowledged tests convert back to being as part of the update to version 15, perhaps?

Sorry, I do not understand this question

Does a test in a disabled state return Bad, Unknown, or Good as its state? If I check the history of this test for the last 24 months, it shows good except since the upgrade to 15.0, at which point it switches to Unknown.

If you checked historical charts and you see green color, this means test was performed.Also you may check log, or use Log Analyzer or just open Test Info window (Ctrl+I) and check Quick Log and User operations log

Regards
Alex

[KS-Soft]

I do not agree. My questions is relevant.
We don't know what test options do you use, we don't know what version of the software you used before update, we don't know what exactly error was set (Timeout or Timed out - as I said these are different errors, indicating different problems). We know nothing.
Then how we should respond and what code should we check? There are thousand HostMonitor versions.

Why its so difficult to answer several simple questions?
Why its so difficult to send couple screen shots by e-mail?
Sometimes we are thinking about totally different problem because description of the error is not clear and we do not see anything on our side. Sometimes customer set test options like "Reverse alert" or "Use Warning status" and forget about these settings, sometimes makes mistake in hostname or IP address and we could not help him because we see nothing.
You see the settings, you see the logs, you have access to the systems. We do not, that's why we need your help.

>So, Hostmonitor is correct and has been correct for the last 10 days.

No, its not correct. I still do not see your settings but regardless of settings test should not return "Timeout" (or "Timed out"?).
If service is not started or not installed but target system responds properly, HostMonitor should set Bad, Unknown or Ok test status (depending on your settings) but error description in Reply field should be different.
Timeout means target system does not respond at all

Regards
Alex

[Alex.Gallegos]

The reply was "Timed out" and we have used every version since version 12. We noted the test results after upgrading from version 14.96 to version 15.

Then how we should respond and what code should we check? There are thousand HostMonitor versions.

Why its so difficult to answer several simple questions?
Why its so difficult to send couple screen shots by e-mail?

It's not difficult, it's that I don't think there's a problem with Hostmonitor and I was wrong to file a bug report. The issue is that a service monitor was configured to monitor the service by the name "WinDefend." But when I checked the services on the servers, not only was the WinDefend service not running, there was no WinDefend service. The WinDefend service does not exist.

I think the only "error" was mine, because I was wrongly confident that we had Windows Defender on our servers when we don't. I should have checked as soon as I noted it but I didn't, I wrongly assumed it was the upgrade.

If you still want me to send a screenshot to support I will but my question and bug report seem silly and erroneous to me now. They are like asking, "I set up a service monitor for a service called ThisServiceIsNotReal. Why can't Hostmonitor find it?" No reasonable person should expect the software to be able to monitor services that don't exist, so I don't think there's any technical problem for the Hostmonitor team to attempt to resolve. This is simply user error on my part.

[KS-Soft]

Yes, it would be useful to see test settings because its not your mistake and looks like its not HostMonitor error. There is some Windows problem - "Timed out" means Windows API hungs and does not return any result to HostMonitor so HostMonitor has to kill thread after 15 min. This may lead to resources leak..

We cannot reproduce the problem - our systems work correctly in all modes. HostMonitor sets Bad or Unknown test status (depends on test settings) within milliseconds. You don't have to wait 15 min to get the result.

Target system Windows Server 2019 built 17763.
This problem related only to this Windows version?
Which Windows is running on HostMonitor system?

Any problems detected by Auditing Tool (menu View)?
I think its better to use e-mail for this conversation

Regards
Alex

[KS-Soft]

Thank you for details.
There was a bug in version 15.00. Problem fixed in version 15.01, available for download
https://www.ks-soft.net/hostmon.eng/downpage.htm

Regards
Alex