Decode error: Cannot read data

xcentric · Post by **xcentric** » Wed Mar 23, 2011 1:26 am

Having trouble with a server and see this error in the rma agent log.
This is a windows 2003 R2 sp2 domain controller. Only antivirus is installed. hm v8.84 and agent v4.14.

Code: Select all

[3/21/2011 4:16 PM]	active-pdc.motionpoint.local	Decode error: Cannot read data
[3/21/2011 6:10 PM]	active-pdc.motionpoint.local	Decode error: Cannot read data
[3/21/2011 6:13 PM]	active-pdc.motionpoint.local	Decode error: Cannot read data (RMA Manager)
[3/22/2011 1:39 AM]	active-pdc.motionpoint.local	Decode error: Cannot read data
[3/22/2011 3:59 AM]	active-pdc.motionpoint.local	Decode error: Cannot read data
[3/22/2011 6:19 AM]	active-pdc.motionpoint.local	Decode error: Cannot read data
[3/22/2011 8:05 AM]	active-pdc.motionpoint.local	Decode error: Cannot read data
[3/22/2011 11:28 AM]	active-pdc.motionpoint.local	Decode error: Cannot read data
[3/22/2011 4:01 PM]	active-pdc.motionpoint.local	Decode error: Cannot read data
[3/22/2011 6:20 PM]	active-pdc.motionpoint.local	Decode error: Cannot read data
[3/23/2011 1:11 AM]	active-pdc.motionpoint.local	Decode error: Cannot read data

I have read that this may be caused by some other application answering the request from the agent. When this happens according to the hm log the duration is for no more than 9 to 10 minutes then comes back online. All tests for the agent show rma not connected in hm when this happens.

From hm there is a ping test to the server and it has never failed so I know it is not an issue with connectivity between hm and the server. The server to hm on the other hand could be a possibility or would the agent flat out write to the log "unable to connect"?

ESET nod32 antivirus is running on the server and it does use a proxy for monitoring content on ports 80,8081,3128,110. I cannot imagine the antivirus causing the issue but I rule out nothing until I know for sure. We have plenty of other servers with this antivirus.

Here is the antivirus log. Pay attention to the definitiopn update times.
There is a striking simalarity to the agent log. But it is not difinitive.

Code: Select all

3/22/2011 4:13:11 PM	Kernel	Statistical information was sent to ESET.	
3/22/2011 4:11:29 PM	Kernel	Virus signature database successfully updated to version 5976 (20110322).	
3/22/2011 12:32:51 PM	Kernel	Statistical information was sent to ESET.	
3/22/2011 11:12:44 AM	Kernel	Statistical information was sent to ESET.	
3/22/2011 11:10:29 AM	Kernel	Virus signature database successfully updated to version 5975 (20110322).	
3/22/2011 7:12:23 AM	Kernel	Statistical information was sent to ESET.	
3/22/2011 7:10:30 AM	Kernel	Virus signature database successfully updated to version 5974 (20110322).	
3/22/2011 1:11:50 AM	Kernel	Statistical information was sent to ESET.	
3/22/2011 1:10:32 AM	Kernel	Virus signature database successfully updated to version 5973 (20110322).	
3/21/2011 6:26:14 PM	Kernel	Statistical information was sent to ESET.	
3/21/2011 4:10:59 PM	Kernel	Statistical information was sent to ESET.	
3/21/2011 4:08:29 PM	Kernel	Virus signature database successfully updated to version 5972 (20110321).

I could try disabling the client temporarily to see if it has an effect. Not sure if the proxy stays active by merely disabling the protection.
The antivirus engine is not current also. Maybe updating will have an effect the issue if the antivirus is the cause.

Any other insight is appreciated.

Regards

UPDATE: Here is the antivirus log from the hm server.

Code: Select all

3/22/2011 4:34:08 PM	Kernel	Statistical information was sent to ESET.	
3/22/2011 4:32:58 PM	Kernel	Virus signature database successfully updated to version 5976 (20110322).	
3/22/2011 1:58:08 PM	Kernel	Statistical information was sent to ESET.	
3/22/2011 10:28:56 AM	Kernel	Statistical information was sent to ESET.	
3/22/2011 10:23:57 AM	Kernel	Virus signature database successfully updated to version 5975 (20110322).	
3/22/2011 7:24:35 AM	Kernel	Statistical information was sent to ESET.	
3/22/2011 7:23:44 AM	Kernel	Virus signature database successfully updated to version 5974 (20110322).	
3/22/2011 1:22:39 AM	Kernel	Statistical information was sent to ESET.	
3/22/2011 1:18:07 AM	Kernel	Virus signature database successfully updated to version 5973 (20110322).	
3/21/2011 4:17:22 PM	Kernel	Statistical information was sent to ESET.	
3/21/2011 4:07:00 PM	Kernel	Virus signature database successfully updated to version 5972 (20110321).	
3/21/2011 1:52:54 PM	Kernel	Statistical information was sent to ESET.	
3/21/2011 12:07:10 PM	Kernel	Statistical information was sent to ESET.	
3/21/2011 12:03:04 PM	Kernel	Virus signature database successfully updated to version 5971 (20110321).	
3/21/2011 11:06:48 AM	Kernel	Statistical information was sent to ESET.	
3/21/2011 11:03:29 AM	Kernel	Virus signature database successfully updated to version 5970 (20110321).

KS-Soft · Post by **KS-Soft** » Wed Mar 23, 2011 11:14 am

I assume you are using Active RMA?
Yes, this error may appear when RMA connects to some other application so it does not receive data expected from HostMonitor.
Can you setup Passive RMA? May be connection from HostMonitor to remote network will work more reliable?

Regards
Alex

xcentric · Post by **xcentric** » Sat Mar 26, 2011 12:57 pm

Passive RMA did work without issue. But as anal as I am I had to know why active rma was dropping out for 10 minutes every 2-3 hours.

We updated the firmware on all the switches. And now active rma seems to be stable for the moment. It could have been just to reboot the switches as they had about 2+ years of uptime.