Submit a ticketCall us

whitepaperYour VM Perplexities Called, and They Need You to Read This.

Virtualization can give you enormous flexibility with future workloads and can be a key enabler for other areas, like cloud computing and disaster recovery. So, how can you get a handle on the performance challenges in your virtual environment and manage deployments without erasing the potential upside? Learn the four key areas you need to be focusing on to help deliver a healthy and well-performing data center.

Get your free white paper.

Home > Success Center > Network Performance Monitor (NPM) > NPM - Knowledgebase Articles > Dell SecureWorks CarbonBlack sensor prevents MSMQ and SolarWinds Information Service from starting

Dell SecureWorks CarbonBlack sensor prevents MSMQ and SolarWinds Information Service from starting

Created by Justin Wyllys, last modified by Mariusz Handke on Aug 21, 2018

Views: 4,061 Votes: 9 Revisions: 22

Updated: 8-21-2018

Overview

The SolarWinds Information Service (SWIS) and Microsoft Message Queuing (MSMQ) do not function properly on servers installed with Dell SecureWorks CarbonBlack sensor.

The CarbonBlack sensor monitors running processes on the server to identify malicious processes. In environments with this sensor, the MSMQ throws errors in the Windows Application Event logs about a failure in setting permissions due to an access control list violation. 

The following error appears in the SWIS log 

(C:\ProgramData\Solarwinds\InformationService\v3.0\Orion.InformationService.log):

ERROR SolarWinds.InformationService.Core.InformationServiceService - (null)     Information Service failed to open a channel.
System.Messaging.MessageQueueException (0x80004005)
   at System.Messaging.MessageQueue.SetPermissions(AccessControlList dacl)
   at SolarWinds.InformationService.ChangeBroker.Broker.ConfigureUsers(MessageQueue messageQueue)
   at SolarWinds.InformationService.ChangeBroker.Broker.PrepareQueue(ServiceElement serviceElement)
   at SolarWinds.InformationService.Core.InformationServiceService.CreateService(ServiceElement serviceElement, String dnsHostName, Uri baseAddress, Uri baseAddressInfoSvcOnly, InformationService& swisService)
   at SolarWinds.InformationService.Core.InformationServiceService.Start(InformationServiceSettings settings, String baseAddress, String baseAddressHttps)

Environment

  • Any Orion server installed with Dell SecureWorks CarbonBlack sensor 
  • All Orion Core modules

Cause 

The cause is currently unknown. SolarWinds recommends opening a ticket with the CarbonBlack sensor creators - Bit9 Support.

Resolution

Uninstall the Dell SecureWorks CarbonBlack sensor from the server and restart the MSMQ and Orion services.

-or- 

Stop and disable the CarbonBlack sensor service in services.msc, and then restart the MSMQ and Orion services.

 

Last modified

Tags

Classifications

Public