Agent Handler reports server busy, response code 503 (RSD 5.0.5.123)
Last Modified: 2021-12-09 21:58:14 Etc/GMT
Affected Products
Languages:
This article is available in the following languages:
Trellix CEO, Bryan Palma, explains the critical need for security that’s always learning.
As per Gartner, "XDR is an emerging technology that can offer improved threat prevention, detection and response."
Trellix announced the establishment of the Trellix Advanced Research Center to advance global threat intelligence.
Trellix Advanced Research Center analyzes threat data on ransomware, nation-states, sectors, vectors, LotL, MITRE ATT&CK techniques, and emails.
As of May 14, 2024, Knowledge Base (KB) articles will only be published and updated in our new Trellix Thrive Knowledge space.
Log in to the Thrive Portal using your OKTA credentials and start searching the new space. Legacy KB IDs are indexed and you will be able to find them easily just by typing the legacy KB ID.
Agent Handler reports server busy, response code 503 (RSD 5.0.5.123)
Technical Articles ID:
KB89859
Last Modified: 2021-12-09 21:58:14 Etc/GMT Environment
Rogue System Detection (RSD) Sensor 5.0.5 (build 5.0.5.123)
Problem
All Agent to Server communication fails on the impacted Agent Handler, and potentially on the ePO server itself. Typically, the masvc(4392.624) ahclient.Info: Agent handler reports server busy. response code 503. The Perfmon counters collected on the ePO server, specifically for Completed Agent Requests and Open Agent Connections, show that the Apache service is completing zero requests. This issue is different from most max connections issues. Typically, these issues get identified by reduced, but still greater than zero, completed agent requests. The flat lined Completed Agent Requests suggest that the Apache threads are stuck and unable to process any incoming requests. NOTE: Other symptoms that might be observed on the ePO server are max connection errors within the server.log. But, the mere presence of these errors doesn’t guarantee that the solution described in this article applies. To confirm that this article applies, implement the steps in the workaround. If the workaround is success, this article applies. System Change
The RSD Sensor extension 5.0.5.123 was installed.
Cause
All Agent Handler threads are in a hung state. The problem is with the The plug-in code prevents any threads from completing, and eventually resulted in a Solution
The issue is resolved with RSD 5.0.6. Issue resolutions in updates and major releases are cumulative; Technical Support recommends that you install the latest version. To find the most recent release for your product, go to the Product Downloads site.
Our product software, upgrades, maintenance releases, and documentation are available on the Product Downloads site.
NOTE: You need a valid Grant Number for access. See KB56057 - How to download product updates and documentation for more information about the Product Downloads site, and alternate locations for some products. NOTE: This issue was previously resolved with RSD Hotfix 5.0.5.140, which is no longer available. WorkaroundYou must either disable or remove the RSD extension entirely to prevent the issue from reoccurring. If removal of the RSD extension isn’t possible, the RSD plug-ins can be temporarily disabled.
Disable the RSD plug-in by replacing its two .DLL files with 0-byte files of matching file names:
Affected ProductsLanguages:This article is available in the following languages: |
|