The Altiris eXpress Server services (axengine.exe) started randomly stopping

Products

• Ghost Solution Suite

Issue/Introduction

Recently, you started noticing that the Altiris eXpress Server services (axengine.exe) is randomly stopping.

The System event logs show messages like this one:

Log Name:      System
Source:        Service Control Manager
Date:          8/28/2024 5:13:34 PM
Event ID:      7034
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      YourServer.example.com
Description:
The Altiris eXpress Server service terminated unexpectedly.  It has done this 2 time(s).
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="49152">7034</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2024-08-28T22:13:34.9632972Z" />
    <EventRecordID>320790</EventRecordID>
    <Correlation />
    <Execution ProcessID="964" ThreadID="10264" />
    <Channel>System</Channel>
    <Computer>YourServer.example.com</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">Altiris eXpress Server</Data>
    <Data Name="param2">2</Data>
    <Binary>41006C00740069007200690073002000650058007000720065007300730020005300650072007600650072000000</Binary>
  </EventData>
</Event>

Environment

GSS 3.3 RU11

Cause

It was discovered that CrowdStrike Real-time protection labeled AXengine.exe as threat and killed the process in the background. The customer had a recent update on their exclusion rules and it was updated with few services missing (which Altiris eXpress Server services (axengine.exe) was part of the omitted ones). 

Resolution

Review the logs for your antivirus and real-time protection software. 

Make sure our services, in this case axengine.exe (c:\program files (x86)\altiris\express\deployment server\axengine.exe), are part of your exclusions.