Issue/Introduction:
Windows agents in production environment were down in batch with status ENDED_LOST - ended undefined (host terminated prematurely)
All agents were found stopped and need to be manually restarted
The issue happened twice until the moment of recognition.
Error messages:
------------------ Agent's log ---------------
20180207/135139.049 - U1002200 Received an invalid message from partner '*UNKNOWN' via connection '<ip address>'.
20180207/135139.049 - U1002203 Field 'Length' in message header is invalid.
---------- Service Manager log ----------
20180702/135140.142 - U0022042 Process 'UC4 WinX64-Agent X' abnormal ended with access violation.
--------------------------------------------------
Cause:
Investigation:
- When try to verify the ip address, it turns out to be a Network scanning server, it appears that this network scanning server flooded the network with messages to check for operating ports (including operation ports of Windows Agents)
- Windows agents which received the message found it to be invalid and forced shut down.
- This behavior was found and fixed in version 10.0.3
Environment:
Windows Agent 10.0.2
Resolution:
The behavior of forcing shut down after receiving invalid message was fixed from version 10.0.3