Submit a ticketCall us

WebinarWebinar: A checklist for planning your Network Performance Monitor (NPM) upgrade

Are you ready for your next upgrade? To help you plan smoothly, join this webcast to learn more about, SolarWinds® Orion® Installer, SolarWinds Upgrade Advisor, Upgrades Guides, Training Videos, and other resources available. We’ll share key upgrade planning considerations, lessons learned from customers with practical advice from SolarWinds Product Experts. We’ll also give practical tips to identify the estimated time needed and resources, how to prepare the business and IT staff for changes, ways to plan for required system changes, and more.

Register now.

Home > Success Center > Network Performance Monitor (NPM) > NPM - Knowledgebase Articles > Dell SecureWorks CarbonBlack sensor prevents MSMQ and SolarWinds Information Service from starting

Dell SecureWorks CarbonBlack sensor prevents MSMQ and SolarWinds Information Service from starting

Created by Justin Wyllys, last modified by Mariusz Handke on Aug 21, 2018

Views: 3,947 Votes: 9 Revisions: 22

Updated: 8-21-2018

Overview

The SolarWinds Information Service (SWIS) and Microsoft Message Queuing (MSMQ) do not function properly on servers installed with Dell SecureWorks CarbonBlack sensor.

The CarbonBlack sensor monitors running processes on the server to identify malicious processes. In environments with this sensor, the MSMQ throws errors in the Windows Application Event logs about a failure in setting permissions due to an access control list violation. 

The following error appears in the SWIS log 

(C:\ProgramData\Solarwinds\InformationService\v3.0\Orion.InformationService.log):

ERROR SolarWinds.InformationService.Core.InformationServiceService - (null)     Information Service failed to open a channel.
System.Messaging.MessageQueueException (0x80004005)
   at System.Messaging.MessageQueue.SetPermissions(AccessControlList dacl)
   at SolarWinds.InformationService.ChangeBroker.Broker.ConfigureUsers(MessageQueue messageQueue)
   at SolarWinds.InformationService.ChangeBroker.Broker.PrepareQueue(ServiceElement serviceElement)
   at SolarWinds.InformationService.Core.InformationServiceService.CreateService(ServiceElement serviceElement, String dnsHostName, Uri baseAddress, Uri baseAddressInfoSvcOnly, InformationService& swisService)
   at SolarWinds.InformationService.Core.InformationServiceService.Start(InformationServiceSettings settings, String baseAddress, String baseAddressHttps)

Environment

  • Any Orion server installed with Dell SecureWorks CarbonBlack sensor 
  • All Orion Core modules

Cause 

The cause is currently unknown. SolarWinds recommends opening a ticket with the CarbonBlack sensor creators - Bit9 Support.

Resolution

Uninstall the Dell SecureWorks CarbonBlack sensor from the server and restart the MSMQ and Orion services.

-or- 

Stop and disable the CarbonBlack sensor service in services.msc, and then restart the MSMQ and Orion services.

 

Last modified

Tags

Classifications

Public