Agents Crashing on Device Type Property

Usage and Config Platform
1

Hello,

I’m currently seeing an issue with the Device Type reserved property.

My client debug log dies with:
“Tue, 26 Jul 2016 09:21:06 -0500 DebugMessage EvalLog actionsite.25:Evaluate Property 1”

It appears property 25:1 is the Device Type property.

With relevance of:

if (exists true whose(if true then exists device type else false ))then device type else(if (exists value of settings "_BESClient_DeviceTypeOverride" of client)then (value of setting "_BESClient_DeviceTypeOverride" of client)else(if(it starts with "Mac OS X")then(if(it contains "Server")then "Server" else (if(((exists key whose(it as string as lowercase contains "battery") of entries of dictionaries of nodes of it) OR (exists node "AppleACPIPlatformExpert/SMB0/AppleECSMBusController/AppleSmartBatteryManager" of service plane of iokit registry)of it)of service plane of iokit registry)then "Laptop" else "Desktop"))else(if (it starts with "Win")then (if (it as lowercase contains "mobile")then "Mobile" else(if (exists key "HKEY_LOCAL_MACHINE\HARDWARE\Description\System\BIOS" whose (value "SystemManufacturer" of it as string as lowercase contains "vmware") of registry)then "Server" else(if (nt workstation product type != product type of operating system)then "Server" else(if (exists active device whose (class of it as lowercase = "battery" AND service key value name of it as lowercase = "cmbatt" AND (description of it as lowercase contains "microsoft acpi" OR description of it as lowercase contains "acpi microsoft")))then "Laptop" else "Desktop"))))else(if (it contains "Linux" OR it contains "AIX" OR it contains "Sun" OR it contains "HP-UX" OR it contains "VMware") then ("Server") else(if((it contains "ios" OR it contains "android" OR it contains "ipad" OR it contains "iphone" OR it contains "ipod" OR it contains "smartphone" OR it contains "msft-" OR it contains "nokia" OR it contains "palm" OR it contains "pocketpc" OR it contains "htc")of(it as lowercase)) then "Mobile" else "Unknown")))))of name of operating system

If I run this relevance in Fixlet Debugger, Fixlet Debugger hard freezes too.

Any ideas?

Bill

1 Like
2

Works OK on my Windows “Desktop” when I run it in QnA/Fixlet Debugger.

What OS are you getting the error under?

3

Silly me … Fixlet Debugger is only available for Windows.

Which version of Windows? I did my testing on a Win 8.1 system.

4

So the agents that aren’t crashing, this evaluates just fine.

The agents where bigfix is crashing has the corresponding debug log entry and fixlet debugger crashes.

It’s a small batch of Windows 7 SP1 x64 machines with Applocker, Bitlocker, EMET 5.5 and McAfee VirusScan 8.8.

Bill

1 Like
5

Which version is the client?

1 Like
6

Is there commonality in the hardware that this is happening for?

I would see if there are BIOS updates available.

I also wonder if the same thing would occur if you turn off EMET & McAfee temporarily.

7

@AlanM - Client is running 9.5.2.56
@jgstew - Optiplex 5040

I’m attempting to add a McAfee Exception and see if that helps!

Bill

1 Like
8

If its a 9.5.2 to determine if its the inspector (as there is a device type inspector on Windows now) you could try blacklisting the inspector?

The inspector does use WMI so wondering if this is a problem on the machine in question?

9

WMI appears to be working in general – is there a specific query you think I could try?

Is there any info about blocking inspectors?

10

There have been a few posts mentioning it but here’s the setting

_BESClient_Inspector_Blacklist
Type: String 
Version: 8.0 
Platform: All 
Default: None 
Requires Client Restart: YES 
Description: Blacklists an inspector list. for example "name of <operating system>"
1 Like
11

I blacklisted the inspector but I am not seeing anything in the client log and it is still hanging on this inspector (after restarting the agent)

1 Like
12

Disabling the WMI inspector worked just fine.

Adding an exception to McAfee VirusScan and rebooting fixed the issue. The issue also occurred in McAfee Endpoint Security – and was also resolved after adding an exception and rebooting.