SMA keeps crashing on Site Servers, due to Module:AeXNetComms.dll errors

book

Article ID: 175690

calendar_today

Updated On:

Products

Management Platform (Formerly known as Notification Server)

Issue/Introduction

The customer reported issues with the Symantec Management Agent (SMA). SMA on Site Servers keep crashing. It is crashing constantly.  AeXNetComms.dll seems to be faulting.  Agent faults a couple of times and then the service does not restart, leaving the Site Server in a Stopped state.
The crash logs shows things like these:

------------------------------------------------------------------------------------
Time: Wednesday, July 17, 2019 12:24:36 AM
Process: AeXNSAgent.exe
Module: AeXNetComms.dll (8.5.4249.0)
Dump File: C:\ProgramData\Symantec\Symantec Agent\CrashDumps\AeXNSAgent_13700_15996_WPDPEU35_2019-07-17_07-24-26.ez2
Process ID: 13700
Thread ID: 15996
Context Record: 000000639E3DEE80
Exception Record: 000000639E3DF370
Exception Code: C0000005
Flags: 00000000
Address: 00007FFF04ABEE0E

RAX=00000063A4D6401E RBX=0000000000053FFE RCX=000000000000001D
RDX=FFFFFFFFF90EC062 RSI=000000639DE51062
RDI=00000063A4D65000 RBP=000000639E3DF6C0 RSP=000000639E3DF5A8 R8
=0000000000000FFF R9 =000000000000000C
R10=000000639DE50080 R11=00000063A4D6401E R12=0000000000000000
R13=0000000000000000 R14=000000639DB8B010
R15=0000000000000FFF RIP=00007FFF04ABEE0E FLG=00010203
CS=0033 DS=002B SS=002B ES=002B FS=0053 GS=002B

------------------------------------------------------------------------------------
Time: Wednesday, July 17, 2019 12:25:20 AM
Process: AeXNSAgent.exe
Module: AeXNetComms.dll (8.5.4249.0)
Dump File: C:\ProgramData\Symantec\Symantec Agent\CrashDumps\AeXNSAgent_19020_7284_WPDPEU35_2019-07-17_07-25-10.ez2
Process ID: 19020
Thread ID: 7284
Context Record: 0000006EC231E9C0
Exception Record: 0000006EC231EEB0
Exception Code: C0000005
Flags: 00000000
Address: 00007FFF04ABEE0E

RAX=0000006EC937401E RBX=0000000000053FFE RCX=000000000000000B
RDX=FFFFFFFFF8ADC032 RSI=0000006EC1E51032
RDI=0000006EC9375000 RBP=0000006EC231F1E0 RSP=0000006EC231F0C8 R8
=0000000000000FED R9 =000000000000000C
R10=0000006EC1E50050 R11=0000006EC937401E R12=0000000000000000
R13=0000000000000000 R14=0000006EC0083200
R15=0000000000000FED RIP=00007FFF04ABEE0E FLG=00010203
CS=0033 DS=002B SS=002B ES=002B FS=0053 GS=002B

--------------------------------------------------------------------------------

------------------------------------------------------------------------------------
Time: Wednesday, July 17, 2019 12:24:36 AM
Process: AeXNSAgent.exe
Module: AeXNetComms.dll (8.5.4249.0)
Dump File: C:\ProgramData\Symantec\Symantec Agent\CrashDumps\AeXNSAgent_13700_15996_WPDPEU35_2019-07-17_07-24-26.ez2
Process ID: 13700
Thread ID: 15996
Context Record: 000000639E3DEE80
Exception Record: 000000639E3DF370
Exception Code: C0000005
Flags: 00000000
Address: 00007FFF04ABEE0E

RAX=00000063A4D6401E RBX=0000000000053FFE RCX=000000000000001D
RDX=FFFFFFFFF90EC062 RSI=000000639DE51062
RDI=00000063A4D65000 RBP=000000639E3DF6C0 RSP=000000639E3DF5A8 R8
=0000000000000FFF R9 =000000000000000C
R10=000000639DE50080 R11=00000063A4D6401E R12=0000000000000000
R13=0000000000000000 R14=000000639DB8B010
R15=0000000000000FFF RIP=00007FFF04ABEE0E FLG=00010203
CS=0033 DS=002B SS=002B ES=002B FS=0053 GS=002B

------------------------------------------------------------------------------------
Time: Wednesday, July 17, 2019 12:25:20 AM
Process: AeXNSAgent.exe
Module: AeXNetComms.dll (8.5.4249.0)
Dump File: C:\ProgramData\Symantec\Symantec Agent\CrashDumps\AeXNSAgent_19020_7284_WPDPEU35_2019-07-17_07-25-10.ez2
Process ID: 19020
Thread ID: 7284
Context Record: 0000006EC231E9C0
Exception Record: 0000006EC231EEB0
Exception Code: C0000005
Flags: 00000000
Address: 00007FFF04ABEE0E

RAX=0000006EC937401E RBX=0000000000053FFE RCX=000000000000000B
RDX=FFFFFFFFF8ADC032 RSI=0000006EC1E51032
RDI=0000006EC9375000 RBP=0000006EC231F1E0 RSP=0000006EC231F0C8 R8
=0000000000000FED R9 =000000000000000C
R10=0000006EC1E50050 R11=0000006EC937401E R12=0000000000000000
R13=0000000000000000 R14=0000006EC0083200
R15=0000000000000FED RIP=00007FFF04ABEE0E FLG=00010203
CS=0033 DS=002B SS=002B ES=002B FS=0053 GS=002B

--------------------------------------------------------------------------------

Cause

The agent logs before the crashes are different each time.
The crash stack is the same:
00 0000000c`a2afee98 00007fff`04aa098c AeXNetComms!memcpy_repmovs+0xe
01 0000000c`a2afeeb0 00007fff`049c7607
AeXNetComms!AsyncIO::WebSocketClientConnection::OnWSConnected+0x58c
02 0000000c`a2aff1f0 00007fff`04a9fa06
AeXNetComms!AsyncIO::WebSocketClientConnection::OnDataReceived+0x137
03 0000000c`a2aff250 00007fff`04a97d0e
AeXNetComms!AsyncIO::WebSocketClientConnection::OnReceiveCompleted+0x36
04 0000000c`a2aff280 00007fff`37af1b4d AeXNetComms!AsyncIO::Socket::Callback+0x5ce
05 0000000c`a2aff320 00007fff`3818c6f2 kernel32!BasepTpIoCallback+0x59
06 0000000c`a2aff370 00007fff`381a92c4 ntdll!TppIopExecuteCallback+0x182
07 0000000c`a2aff400 00007fff`37af13f2 ntdll!TppWorkerThread+0x8b4
08 0000000c`a2aff7e0 00007fff`381854f4 kernel32!BaseThreadInitThunk+0x22
09 0000000c`a2aff810 00000000`00000000 ntdll!RtlUserThreadStart+0x34

 

The crash occurred during policy receiving over WebSocket connection.
For crash to occur the encrypted policy block should be larger than 256KB and be multiple of 4k.

It could happen on any client machine while receiving a large policy, it's just that site server with PS usually has large policies.

Environment

ITMS 8.5 RU2

Resolution

This issue has been reported to Symantec Development team. A fix to this issue has been added to ITMS 8.5 RU3 release.

A pointfix is available for customers with 8.5 RU2. See INFO5407 "CUMULATIVE POST 8.5 RU2 POINT FIXES" under SMP/SMA fixes section.