Zabbix Agent 1.4.4 on Win2k3 R2 (32bit) crash

[qix]

Hello all,

Yesterday I setup a new windows agent installation.
All seemed to be fine till 0:11 tonight. The agent suddenly crashed and was automatically restarted by the service control manager (I set it up that way).

Unfortunately it keeps crashing ever since.
I disabled the automatic restart and set debuglevel to 5.

Attached you will find an excerpt of the eventlog of the agent.
I have no clue as to why the agent crashes.

Disabling remote commands does not work either.

If needed I can supply more info to resolve this issue.

[qix]

When I disable the active agent items in my Zabbix Server configuration, the agent starts normally without crashing directly.

[Alexei]

Unfortunately the provided information is not enough to troubleshoot this.

[qix]

Hi Alexei,

Can you tell me what you need from me in order to get the problem more clear for the Zabbix Team?

(logs, items, ???)

Since I disabled the active items (eventlogs) on the Zabbix server the agent has been running fine up till now. (no errors in eventlog nor events in Zabbix server. Latest data is up to date.)

So my guess is that the problem lies either in "eventlog monitoring" or in "active agent".

[Alexei]

I need detailed pre-crash log file with Debug set to 4.

[qix]

Hi Alexei,

I first restarted the agent on the host so it would give it's startup log.
When this was finished I turned on the eventlog monitoring items.
Soon after the agent crashed.

Please find the attached log (It was too big for the forum, so I zipped it).

Thanks for the help,

[Alexei]

It doesn't look like a log file generated by ZABBIX agent.

[qix]

It's the logging that the agent leaves in the eventlog.
I cannot get the agent to log directly into a file (see: http://www.zabbix.com/forum/showthread.php?t=7571
)

I've tried:

• logfile=zabbix.log
• logfile=c:\zabbix.log

But both won't appear and the agent still logs to eventlog.

[qix]

Ok, just out of plain curiosity I changed "logfile" to "LogFile" and guess what?

I get a nice logfile!
I didn't realize the agent was case sensitive about its config file....

Attached is a new crashlog.
The end of the log just stops (the agent is dead, I checked), no indication of a process crash or anything....

[Alexei]

It crashed at 17:10:42? Actually I do not see anything suspicious in the log file.

[qix]

Yes, it crashed at 17:10:42. That is the last log entry in the file and the agent wasn't running anymore.

I do not see anything in the log file either.
I can however reproduce it.When eventlog items are disabled, everything runs smooth.
As soon as I enable evntlog monitoring and the agent checks for active items, the agent crashes without any clues whatsoever.

My guess at this point is that the agent cannot handle one of the log entries in the eventlog and therefor crashes.

If this is the case, can you help me find out which log entry that could be?