Agent Failing and Constantly Restarting

Last Modified

Mon Mar 23 00:18 GMT 2020

Description

  • Large number of Event ID 12289 from N-able N-centralN-able N-central spamming the event viewer and agent goes to a failed state.
  • Sample Log Entry (AgentMaint.log)
    • [8] 2017-11-08 05:17:47,703 INFO  com.nable.agent.UpdateClient.UpdateController MMS Url:https://rmm2.ptcomputers.com/dms/services/ServerMMS[8] 2017-11-08 05:17:47,719 ERROR com.nable.agent.UpdateClient.UpdateController MaintActionGet Error: Unable to connect to the remote server[8] 2017-11-08 05:17:47,719 ERROR com.nable.agent.UpdateClient.UpdateController MaintActionGet Error: An operation on a socket could not be performed because the system lacked sufficient buffer space or because a queue was full 192.199.15.165:443

Environment

  • N-able N-central
  • Windows Agent

Solution

  • EventID 12289 is the Windows Service Manager registering a restart attempt for the Windows Agent.
  • This is, by itself, fairly normal behavior should something happen to the agent the Windows Agent Maintenance Service is designed to attempt a self-repair and restart.
  • The key item to look for will be any .NET failures which will trigger an agent failure.
  • After that, looking in Agent.log and AgentMaint.log around the time of the restarts should shed some light on the problem.
  • The error message in the description indicates that something outside the agent is preventing access to port 443, and in such a case while the event is happening a 'netstat -a' may show which applications or services are locking up the port and creating the socket error.
  • In that instance, there was also an error on port 80 which would also be locked at the time.