Submit a ticketCall us

Webinar: Web Help Desk for HR, Facilities and Accounting Departments
This webinar will focus on use cases for HR, Facilities and Accounting.

Having a unified ticketing and asset management system for all the departments in your company can provide end-users with a seamless experience and make things easier for your IT team. Yet, with different business tasks and objectives, many departments don’t fully understand the capabilities of Web Help Desk and how the software can be customized for effective use in their departments.
Register Now.

Home > Success Center > Network Performance Monitor (NPM) > Dell SecureWorks CarbonBlack sensor prevents MSMQ and SolarWinds Information Service from starting

Dell SecureWorks CarbonBlack sensor prevents MSMQ and SolarWinds Information Service from starting

Created by Justin Wyllys, last modified by Magdalena.Markova on Mar 08, 2017

Views: 452 Votes: 8 Revisions: 20

Updated: 8-16-2016

Overview

The SolarWinds Information Service (SWIS) and Microsoft Message Queuing (MSMQ) do not function properly on servers installed with Dell SecureWorks CarbonBlack sensor.

The CarbonBlack sensor monitors running processes on the server to identify malicious processes. In environments with this sensor, the MSMQ throws errors in the Windows Application Event logs about a failure in setting permissions due to an access control list violation. 

The following error appears in the SWIS log 

(C:\ProgramData\Solarwinds\InformationService\v3.0\Orion.InformationService.log):

ERROR SolarWinds.InformationService.Core.InformationServiceService - (null)     Information Service failed to open a channel.
System.Messaging.MessageQueueException (0x80004005)
   at System.Messaging.MessageQueue.SetPermissions(AccessControlList dacl)
   at SolarWinds.InformationService.ChangeBroker.Broker.ConfigureUsers(MessageQueue messageQueue)
   at SolarWinds.InformationService.ChangeBroker.Broker.PrepareQueue(ServiceElement serviceElement)
   at SolarWinds.InformationService.Core.InformationServiceService.CreateService(ServiceElement serviceElement, String dnsHostName, Uri baseAddress, Uri baseAddressInfoSvcOnly, InformationService& swisService)
   at SolarWinds.InformationService.Core.InformationServiceService.Start(InformationServiceSettings settings, String baseAddress, String baseAddressHttps)

Environment

  • Any Orion server installed with Dell SecureWorks CarbonBlack sensor 
  • All Orion Core modules

Resolution

1. Uninstall the Dell SecureWorks CarbonBlack sensor from the server and restart the MSMQ and Orion services.

2. Stop and disable the CarbonBlack sensor service in services.msc, and then restart the MSMQ and Orion services.

Cause 

The cause is currently unknown. SolarWinds recommends opening a ticket with the CarbonBlack sensor creators - Bit9 Support.

 

 

Last modified
06:48, 8 Mar 2017

Tags

Classifications

Public