Troubleshooting Services Restarting

Products

• Carbon Black App Control

Issue/Introduction

How to troubleshoot when the services are stopping and starting for an unknown reason

Environment

• App Control Server: All Supported Versions
• Windows OS: All Supported Versions

Resolution

Check application and system event log to confirm if this is a crash or a normal service restart

• • Event ID 1000 from the application event log will indicate that the application service is crashing
    1. Typically a crash is more likely to crash on a more abnormal schedule 
    2. If it crashes regularly run a procmon on the system during the crash if possible
    3. Make sure that AV Exclusions are in place checking the procmon if needed
  • Event ID 7036 from the system event log will indicate a service being started or stopped normally
    1. Double check when it's restarting and if there is a specific trend in time or how often
    2. Check the scheduled tasks on the server to see if a task is stopping or restarting it
    3. Look for 4624 events on the security log to see at the time of service restart the user and Source Network Address if it's coming over the network
  • If assistance is needed from support pull the full server logs