Submit a ticketCall us

AnnouncementsChange Is Inevitable

Get valuable help when it comes to tracking and monitoring changes. SolarWinds® Server Configuration Monitor (SCM) is designed to help you: detect, track, and receive alerts when changes occur, correlate system performance against configuration changes, compare server and application configuration against custom baselines, and verify application and system changes.

Learn more.

Home > Success Center > Network Performance Monitor (NPM) > NPM - Knowledgebase Articles > Dell SecureWorks CarbonBlack sensor prevents MSMQ and SolarWinds Information Service from starting

Dell SecureWorks CarbonBlack sensor prevents MSMQ and SolarWinds Information Service from starting

Created by Justin Wyllys, last modified by Mariusz Handke on Aug 21, 2018

Views: 3,779 Votes: 9 Revisions: 22

Updated: 8-21-2018

Overview

The SolarWinds Information Service (SWIS) and Microsoft Message Queuing (MSMQ) do not function properly on servers installed with Dell SecureWorks CarbonBlack sensor.

The CarbonBlack sensor monitors running processes on the server to identify malicious processes. In environments with this sensor, the MSMQ throws errors in the Windows Application Event logs about a failure in setting permissions due to an access control list violation. 

The following error appears in the SWIS log 

(C:\ProgramData\Solarwinds\InformationService\v3.0\Orion.InformationService.log):

ERROR SolarWinds.InformationService.Core.InformationServiceService - (null)     Information Service failed to open a channel.
System.Messaging.MessageQueueException (0x80004005)
   at System.Messaging.MessageQueue.SetPermissions(AccessControlList dacl)
   at SolarWinds.InformationService.ChangeBroker.Broker.ConfigureUsers(MessageQueue messageQueue)
   at SolarWinds.InformationService.ChangeBroker.Broker.PrepareQueue(ServiceElement serviceElement)
   at SolarWinds.InformationService.Core.InformationServiceService.CreateService(ServiceElement serviceElement, String dnsHostName, Uri baseAddress, Uri baseAddressInfoSvcOnly, InformationService& swisService)
   at SolarWinds.InformationService.Core.InformationServiceService.Start(InformationServiceSettings settings, String baseAddress, String baseAddressHttps)

Environment

  • Any Orion server installed with Dell SecureWorks CarbonBlack sensor 
  • All Orion Core modules

Cause 

The cause is currently unknown. SolarWinds recommends opening a ticket with the CarbonBlack sensor creators - Bit9 Support.

Resolution

Uninstall the Dell SecureWorks CarbonBlack sensor from the server and restart the MSMQ and Orion services.

-or- 

Stop and disable the CarbonBlack sensor service in services.msc, and then restart the MSMQ and Orion services.

 

Last modified

Tags

Classifications

Public