BESClient Keeps Stopping

Usage and Config Platform
1

On one of my laptops (Win7), the BESClient service stops running. I have no idea why. If I go over to it and start the service again, then refresh the console, the gray turns to black and all is ok. Anyone know what could be causing this problem? Thanks.

2

Anything in the BES client log files? How about the event viewer?

1 Like
3

The only thing in the log is “user interface process ended.” Sounds like BigFix is working properly and maybe it is a Win7 problem that is shutting down the service.

4

so you start it back up and it stays running or does it stop after a while?

If I recall correctly, the “user interface process ended” is when someone logs off. Is it possible that they are rebooting and the service is not set to automatic?

You may have to look in the event viewer for more information.

5

If the client service itself has stopped it should indicate why in the log. If your clients are going grey in the console it doesn’t mean they are stopped, it could be they are very busy and haven’t been able to report within the time period that is set in the console for them to go grey in.

The ClientUI comes and goes depending on who is using the machine but the Client service should stay running

6

This definitely shouldn’t be happening.

If you find it stopped, grab the newest log and post the last set of lines, redacting any server info.

What version of the client is it?

Is the client service set to automatic, delayed start?

7

I have the same issue except starting manually just results in failure:
Service is set to automatic.

From the logs:
Current Date: June 15, 2016 Client version 9.2.6.94 built for Windows 5.1 i386 running on WinVer 6.1.7601 Current Balance Settings: Use CPU: True Entitlement: 0 WorkIdle: 10 SleepIdle: 480 ICU data directory: 'C:\Program Files (x86)\BigFix Enterprise\BES Client' ICU init status: SUCCESS ICU report character set: windows-1252 ICU fxf character set: windows-1252 ICU local character set: windows-1252 ICU transcoding between fxf and local character sets: DISABLED ICU transcoding between report and local character sets: DISABLED At 15:12:42 -0300 - Starting client version 9.2.6.94 FIPS mode disabled by default. Cryptographic module initialized successfully. Using crypto library libBEScrypto - OpenSSL 1.0.1p-fips 9 Jul 2015 Restricted mode Adding operator site (josetruj_nmo) Adding operator site (meylan_nmo) Adding operator site (__op_10) Adding operator site (__op_103) Adding operator site (__op_169) Adding operator site (__op_186) Adding operator site (__op_213) Adding operator site (__op_214) Adding operator site (__op_215) Adding operator site (__op_229) Adding operator site (__op_301) Initializing Site: BES Support Initializing Site: CustomSite_FileOnlyCustomSite_WAM Initializing Site: CustomSite_IBM_Enterprise_Admin Initializing Site: CustomSite_IBM_Enterprise_Admin_-2d_ITMS Initializing Site: CustomSite_IBM_ITCS_300_-28Windows-29 Initializing Site: CustomSite_IBM_ITCS_300_Exceptions Initializing Site: CustomSite_IBM_SEC_SW_Migration Initializing Site: CustomSite_IBM_Trusteer_APEX Initializing Site: CustomSite_IBM_WIN_DESK_App_Patch Initializing Site: CustomSite_IBM_WIN_DESK_Patch Initializing Site: CustomSite_IBM_WIN_DESK_Patch_-2d_ENG Initializing Site: CustomSite_IBM_WIN_DESK_Patch_Base Initializing Site: CustomSite_IBM_Workstation_Config_-2d_Windows Initializing Site: CustomSite_UAT_Removal_of_web_filtering Initializing Site: CustomSite_UAT_WebContent_Filtering-2dGlobal Initializing Site: CustomSite_WAM Initializing Site: mailboxsite Beginning Relay Select At 15:12:43 -0300 - RegisterOnce: Attempting secure registration with '<redacted>' At 15:12:44 -0300 - Unrestricted mode Configuring listener without wake-on-lan Registered with url '<redacted>' Registration Server version 9.2.6.94 , Relay version 9.2.6.94 Relay requires client authentication. Client has an AuthenticationCertificate Relay selected: <redacted>. at: <redacted> on: IPV4 At 15:12:45 -0300 - PollForCommands: Requesting commands PollForCommands: commands to process: 17 At 15:12:46 -0300 - Entering service loop At 15:12:48 -0300 - actionsite (<redacted>) Gather::SyncSiteByFile deleting files - count: 4 At 15:12:55 -0300 - Retry error, attempt 9 failed for ForceNonexistence (C:\Program Files (x86)\BigFix Enterprise\BES Client\__BESData\actionsite\conntst.txt) Gather::SyncSiteByFile caught FileIOError (5) FileIOError At 15:12:55 -0300 - actionsite (<redacted>) FAILED to Synchronize - Site data corrupted. - gather url - <redacted> At 15:12:55 -0300 - ActiveDirectory: Refreshed Computer Information - Domain: (N/A) At 15:12:56 -0300 - Client shutdown (No action site)

8

I just figured it.

Findstr.exe had a log on conntst.txt for some reason. (no idea why)

Steps I took:

  1. Find process with lock via Resource Monitor ‘Associated Handles’ search.
  2. Kill process
  3. Delete file C:\Program Files (x86)\BigFix Enterprise\BES Client__BESData\actionsite\conntst.txt
  4. Start service
9

Will it be clear in ‘Associated Handles’ which file BESclient is locked on? I am not really seeing that it does. I am seeing many file handles associated with besclient, but non are indicating locked.

10

You’d be looking for handles under __BESData from any process other than from besclient.exe if you think there’s potentially a file locking issue. Based on the other thread going, I thought we were looking at WMI timeouts though?