UCM Collector unstable

Products

CA Unified Communications Monitor (NetQoS / UCM)

Issue/Introduction

Unified Communications Monitor Collector keeps restarting. Lots of VoIPAgentCollector.dmp files located in /CA/VoIPMonitor/crashdumps/voipagentcollector/

Environment

Release: UCMMCN99000-3.8-Unified Communications Monitor-Management Console-SW
Component:

Cause

UCM collects SIP data on Ports 5060 and 5061 by default. Port 5061 is used for SIP authenticated messages and encrypted messages. When receiving SIP encrypted messages we are unable to reassemble the packets causing the collector to crash.

Resolution

Disable port 5061 on the collector.

Stop all services on the collector
Open vcAgentCurrentState.txt in the \CA\VoIPMonitor\bin\ directory Towards the bottom you will see SIP port=5060;5061
Remove ";5061"

Now the line should read

SIP port=5060

Save the file and reboot the server.

Additional Information

Common log entries describing the problem

VoIPAgent.log

04:35:54 Severity 3 - Crashing because Windows exception handler was invoked

SNMPTraps.log

SNMP TRAP: 09/17/2015 04:35 EST
Source: x.x.x.x
Destination: x.x.x.x
Profile name: 'Send'
Enterprise: 1.3.6.1.4.1.4498
TrapType: netQoSVoIPMonitorCollectorAbendIncident
[1.3.6.1.4.1.4498.3.24.1.1] netQoSVoIPMonitorCollectorIncidentNumber: '42173'
[1.3.6.1.4.1.4498.3.24.1.2] netQoSVoIPMonitorCollectorIncidentType: 'Collector'
[1.3.6.1.4.1.4498.3.24.1.3] netQoSVoIPMonitorCollectorIncidentCollectorName: 'collector1'
[1.3.6.1.4.1.4498.3.24.1.4] netQoSVoIPMonitorCollectorIncidentCollectorAddress: 'x.x.x.x'
[1.3.6.1.4.1.4498.3.24.1.5] netQoSVoIPMonitorCollectorIncidentMetric: 'CollectorAbnormalTermination'
[1.3.6.1.4.1.4498.3.24.1.6] netQoSVoIPMonitorCollectorIncidentMetricValue: 'C:\CA\VoIPMonitor\CrashDumps\VoIPAgentCollector\VoIPAgentCollector000.dmp'
[1.3.6.1.4.1.4498.3.24.1.7] netQoSVoIPMonitorCollectorIncidentTime: '09/17/2015 04:35 EST'
[1.3.6.1.4.1.4498.3.24.1.8] netQoSVoIPMonitorCollectorIncidentSeverity: 'Excessive'
[1.3.6.1.4.1.4498.3.24.1.9] netQoSVoIPMonitorCollectorIncidentURL: 'http://x.x.x.x/UCMonitor/default.aspx?pg=80311&mn=80023&IncidentID=42173&IncidentType=9&ID1=5&Type1=coll'

VoIPAgentCollector000.dmp

Dump Summary
------------
Dump File:          VoIPAgentCollector000.dmp : \VoIPMonitor\VoIPMonitor\CrashDumps\VoIPAgentCollector\VoIPAgentCollector000.dmp
Last Write Time:               9/17/2015 04:35:45 AM
Process Name: vcagent.exe : C:\CA\VoIPMonitor\bin\vcagent.exe
Process Architecture:     x86
Exception Code:               0xC0000005
Exception Information: The thread tried to read from or write to a virtual address for which it does not have the appropriate access.
Heap Information:           Not Present
System Information