Data to gather for Support for DCS Agent issues with crashes or service issues

Products

• Data Center Security Server Advanced

Issue/Introduction

A system with Symantec Data Center Security (DCS) is experiencing an issue with one of it's services.

Environment

Symantec DCS Windows Agent 6.x

Resolution

Please enable low level debugging as listed below

1. Turn on full windows process dump.
   See: https://learn.microsoft.com/en-us/windows/win32/wer/collecting-user-mode-dumps
2. Turn on DCS agent trace log
   sisipsconfig.bat -trace
3. Launch Procmon32Low and enable “Enable Boot Logging”.
4. Restart the computer, and try to reproduce this issue.

After the issue has been reproduced or reoccurs, please stop and collect the following items

1. Crash dumps (if there are any)
2. Procmon32Low boot log
3. GAI logs set - How to collect a GAI

Procmon23Low Details - How to Generate a low-altitude Process Monitor trace. 

1. Download Procmon23Low.zip from the attachments section at the bottom of this KB. (Note: the attached file at the bottom of this KB will have a version number in front of the file name)
2. Right-click Procmon23Low.zip, select Extract All..., and extract the file to a location of your choice.
3. Navigate to extracted files location, and run Procmon32Low.exe.
4. Click Agree to agree to the license terms.
5. When the Process Monitor Filter pop-up window appears, click Reset, click Apply, and then click OK.
6. Click File > Capture Events to stop the capture. Ensure this option is now unchecked.
7. Click Edit > Clear Display to clear the display.
8. Click Options > Enable Boot Logging
   Check the option "Generate thread profiling events", Every Second
9. After you enable PML booting logging, you can restart your computer. After the issue is reproduced, you can run Procmon23Low again and it will prompt you to save the booting log. Typically, PML booting logging does not have a noticeable impact on performance.