Heartbeat agent error after Windows Updates

0 votes
asked Sep 25, 2017 in EventSentry Web Reports by Phil
The last two times after doing monthly Windows updates under Heartbeat status all of our agents report as Error with a description of disconnected.  If I log into the EventSentry application and restart the heartbeat agent control it fixes the issue.  Is this expected behavior?


2 Answers

0 votes
answered Sep 25, 2017 by Ingmar (6,420 points)
Hi Phil,

No, this is definitely not expected behavior, we're not currently aware of this or similar issues. Do you use the collector service in your setup?

When this happens and you look at the heartbeat status, is the timestamp associated with each line item up to date, or outdated? Is the ping status accurate? I realize that you may not have this info, but knowing this would be helpful the next time it happens.

Please also set the debug level on the "Heartbeat" dialog to "High" and save the configuration. The next time this happens, please immediately copy the files from %systemroot%\syswow64\eventsentry\logs\eventsentry_hb_svc*.log to a temporary folder in case we need to review them.

+1 vote
answered Sep 25, 2017 by anonymous

We are not using a collector service.  Below is log info from one server.  Updates were done on the 24th around 6pm.  I restarted heartbeat agent at 9:34am on the 25th.


commented Sep 26, 2017 by Ingmar (6,420 points)
Thanks for the additional info. Is the host where the heartbeat service runs also being rebooted during the monthly windows updates?

Where is the database located (local or remote?), and is the DB server rebooted during the patch cycle as well?

Was the host running the heartbeat service rebooted during the patch cycle as well?
commented Sep 26, 2017 by anonymous
The ES application, database (sql server) and web reports are all on different servers.  Web reports are on a Linux server.  They were all rebooted during the patch cycle.  The heartbeat service is running on the same server as the ES application.
commented Sep 26, 2017 by Ingmar (6,420 points)
It looks like the HB service is not recovering correctly from a DB outage, something we will look into. In the meantime, is it possible to reboot the host running the EventSentry Heartbeat Service after the SQL Server that it depends on?
commented Sep 26, 2017 by anonymous
We use SCCM to manage Windows updates.  There is a maintenance window that reboots occur in.  I would prefer not to make that process more complicated by forcing reboots in a specific order.
commented Sep 27, 2017 by Ingmar (6,420 points)
That's fine, if that would have been an option for you then it would have been a potential work-around. We're currently testing this on our end to see if we can reproduce this issue, we'll keep you posted. Thank you for your patience.
commented Sep 30, 2017 by Ingmar (6,420 points)
So far we have, unfortunately, not been able to reproduce this behavior. The HB agent should update the status table reliably, even if the database is temporarily unavailable. Can you let me know which version of EventSentry you are running? Are you on the latest 3.3 build?
Welcome to EventSentry Q&A, where you can ask questions and receive answers from other members of the community.