Symantec Management Agent upgrade process is terminating other processes that are blocking the upgrade

Products

• IT Management Suite

Issue/Introduction

The customer noticed that during the Symantec Management Agent (SMA) upgrade process that some applications are been terminated. While looking at the most recent Agent Installation Log (under C:\Programdata\Symantec\Symantec Agent\Install logs), it shows what processes were blocking the upgrade and that our agent was terminating them.

 

*WARM Installer: Process 'javaw.exe' blocks 'C:\Program Files\Common Files\Altiris\AeXNetComms.dll' and will be terminated.

Environment

Prior ITMS 8.5 RU1 (8.5 RU1 agent is the last version that should behave this way)

Cause

Working as designed. This behavior has been changed starting with the agent for 8.5 RU1. 8.5 RU1 introduced a change to avoid this. When upgrading to 8.5 RU2 from 8.5 RU1 should not display this behavior anymore.

Is this expected, the agent upgrade terminating other applications if those are blocking our agent? (any agent version prior to 8.5 RU1)
Unfortunately yes, this is related to SMA performance counters. The performance counters are registered in the system and aexnetcomms.dll is where performance counters strings are stored.

Any application that loads all performance counters will load aexnetcomms.dll. Usually the application do not actually need our counters they just load everything because of the bad code  or bad design.

So our setup will try killing any process that blocks SMA from upgrade, the alternative is a failed upgrade, which we don't want to happen.

Our Dev team could start back those application that were terminated but that is quite complicated in some cases because a lot of apps require some command line or they are services, etc.

 

Resolution

Dev made some changes starting with SMA 8.5 RU1. The problem with aexnetcomms.dll is fixed in 8.5 RU1, i.e. so, when a customer upgrades to 8.5 RU2, it should not kill those processes anymore.

The performance counters strings have been moved from aexnetcomms.dll to aexperfctrs.GUID.dll.

So, now that the customer is finishing upgrading to 8.5 RU1, it should be the last time that he sees this behavior, since the 8.5 RU1 agent introduced the new change on how we did the termination on blocking processes.