Bigfix clients from time to time will crash when being sent a task to run. The tasks will not show any errors. No error logs in the Bigfix client log.
Only one error "The BES Client service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service."
No other errors found in the sys and application logs.
You might want to turn up the logging level via a task in the BES support site. See if that log captures anything noteworthy. You may also need to open a support case.
I’ve seen similar errors caused by a variety of issues including IBM bugs that were resolved by APARs or by bad/corrupt relevance in custom task/fixlet/baseline/analysis.
1 Like
Yes the debug level has been set to the clients. I also set an analysis to check devices with WER errors from client crashes in the WER folder in the c:\programdata\microsoft\Windows\WER. I have identified over 1500 devices with a BES client crash, but I am not able top correlate it definitely that the crashes are happening because of tasks sent, nor can i determine what created the crash.
I have also recently written analysis to detect which devices are failing Windows update and see if there is a correlation with these devices and the BES client crash.
How can i determine if its a bad relevance if the relevance passes and completes with the majority of devices in the field?
The EMSG logs can be set to display the fixlet ID number before they evaluate the content and thus you can point to a piece of content if there is an issue - look for the setting _BESClient_EMsg_EvalLog