Submit a ticketCall us

Looking to compare latest NPM features with previous versions of NPM?
The NPM new feature summary offers a comparison of new features and improvements offered with this release.

 

 

 

 

Home > Success Center > Network Performance Monitor (NPM) > Dell SecureWorks CarbonBlack sensor prevents MSMQ and SolarWinds Information Service from starting

Dell SecureWorks CarbonBlack sensor prevents MSMQ and SolarWinds Information Service from starting

Created by Justin Wyllys, last modified by Magdalena.Markova on Mar 08, 2017

Views: 4 Votes: 8 Revisions: 20

Updated: 8-16-2016

Overview

The SolarWinds Information Service (SWIS) and Microsoft Message Queuing (MSMQ) do not function properly on servers installed with Dell SecureWorks CarbonBlack sensor.

The CarbonBlack sensor monitors running processes on the server to identify malicious processes. In environments with this sensor, the MSMQ throws errors in the Windows Application Event logs about a failure in setting permissions due to an access control list violation. 

The following error appears in the SWIS log 

(C:\ProgramData\Solarwinds\InformationService\v3.0\Orion.InformationService.log):

ERROR SolarWinds.InformationService.Core.InformationServiceService - (null)     Information Service failed to open a channel.
System.Messaging.MessageQueueException (0x80004005)
   at System.Messaging.MessageQueue.SetPermissions(AccessControlList dacl)
   at SolarWinds.InformationService.ChangeBroker.Broker.ConfigureUsers(MessageQueue messageQueue)
   at SolarWinds.InformationService.ChangeBroker.Broker.PrepareQueue(ServiceElement serviceElement)
   at SolarWinds.InformationService.Core.InformationServiceService.CreateService(ServiceElement serviceElement, String dnsHostName, Uri baseAddress, Uri baseAddressInfoSvcOnly, InformationService& swisService)
   at SolarWinds.InformationService.Core.InformationServiceService.Start(InformationServiceSettings settings, String baseAddress, String baseAddressHttps)

Environment

  • Any Orion server installed with Dell SecureWorks CarbonBlack sensor 
  • All Orion Core modules

Resolution

1. Uninstall the Dell SecureWorks CarbonBlack sensor from the server and restart the MSMQ and Orion services.

2. Stop and disable the CarbonBlack sensor service in services.msc, and then restart the MSMQ and Orion services.

Cause 

The cause is currently unknown. SolarWinds recommends opening a ticket with the CarbonBlack sensor creators - Bit9 Support.

 

 

Last modified
06:48, 8 Mar 2017

Tags

Classifications

Public