Sign In with your
Trend Micro Account
Need Help?
Need More Help?

Create a technical support case if you need further support.

Debugging issues when the OfficeScan server services terminate unexpectedly

    • Updated:
    • 17 Oct 2016
    • Product/Version:
    • OfficeScan 10.6
    • OfficeScan 11.0
    • OfficeScan XG.All
    • Platform:
    • Windows 2003 Compute Cluster Server
    • Windows 2003 Datacenter Server
    • Windows 2003 Datacenter Server Edition 64-bit
    • Windows 2003 Enterprise Server
    • Windows 2003 Standard Server Edition
    • Windows 2003 Standard Server Edition 64-bit
    • Windows 2003 Storage Server
    • Windows 2003 Web Server Edition
    • Windows 2008 Datacenter Server
    • Windows 2008 Datacenter Server Edition 64-bit
    • Windows 2008 Enterprise Server
    • Windows 2008 Enterprise Server Edition 64-bit
    • Windows 2008 Standard Server Edition
    • Windows 2008 Standard Server Edition 64-bit
    • Windows 2008 Storage Server
    • Windows 2008 Web Server Edition
    • Windows 2008 Web Server Edition 64-bit
Summary

There have been reports that the OfficeScan Master Service is randomly terminating and the Event Viewer logs may show errors similar to the following:

Faulting application ofcservice.exe, version X, faulting module ofcservice.exe, version x, fault address xxxxxxx.
Faulting application DbServer.exe, version x, time stamp x, faulting module DbServer.exe, version x, time stamp x, exception code x, fault offset x, process id 0x1dfc, application start time x.
Faulting application name: verconn.exe, version: 10.5.0.1766, time stamp: 0x4d1b84f8
Faulting module name:verconn.exe, version 10.5.0.1766 , time stamp: 0xd1b84f8
Details
Public

To understand the root cause why the OfficeScan server process(es) randomly terminate(s), we recommend using the ADPlus tool from Microsoft. This tool does not require enabling debugging for OfficeScan. The ADPlus will automatically generate a dump file when a crash or exception occurs.

To use ADPlus:

  1. Download and install the Debugging Tools for Windows. ADPlus is part of the Debugging Tools for Windows.
  2. Open a command prompt and go to the directory where the Debugging Tools for Windows is installed. By default, it is at C:\Program Files\Debugging Tools for Windows\.
     
    Run ADPlus on the server itself.
  3. Execute this command:

    "adplus -crash -pn ofcservice.exe -o C:\temp"

    Some points to consider:

    • C:\TEMP can be any other directory. Just make sure that the path exists.
    • If you see this same command to troubleshoot dbserver.exe, then substitute ofcservice.exe with dbserver.exe. Example: "adplus -crash -pn dbserver.exe -o C:\temp"
     
    Do not close the DOS window(s) that ADPlus opened. ADPlus will run in the background while waiting for the process to crash. Also make sure not to recycle the OfficeScan Master service or reboot after running the command because ADPlus uses the PID.
    If the server is restarted or the machine is rebooted, the OfficeScan Master service will get a new PID and you will not be able to capture the dump. Once the crash happens, ADPlus willo generate the crash dump and terminate automatically.
  4. Once the process crashes, collect the logs generated by ADPlus under the C:\Temp folder.
  5. Send the logs to Trend Micro Technical Support for further analysis.

On certain occasions, ADPlus only catches the first chance of the crash. This first chance has limited use for troubleshooting and is therefore recommended to move up to the second method of capturing a process dump file using WinDBG.

To use WinDBG to capture a dump:
  1. After installing Debugging Tools for Windows, open a command prompt and go to the directory where the Debugging Tools for Windows is installed. By default, it is in C:\Program Files\Debugging Tools for windows\.
  2. Type this command:

    "Windbg.exe -i"

    You will see a message box showing "WinDBG has successfully installed as the default postmortem debugger".
  3. Once the process crashes, the WinDBG window will be launched. Type the following commands to capture the dump within the WinDBG window:

    ".dump /ma c:\temp\processname.dmp"
    "q"

    Here are some points that you should consider:
    • C:\temp can be any existing directory.
    • The process name is the name of the executable that you are troubleshooting.
      For example, if you are troubleshooting a crash in dbserver.exe, then substitute processname.dmp to dbserver.dmp:

      ".dump /ma c:\temp\dbserver.dmp"

    • The "q" command indicates quit. You do not have to run anything after capturing the dump.
  4. Send the captured dump to Trend Micro Technical Support for further analysis.
Premium
Internal
Rating:
Category:
Troubleshoot
Solution Id:
1056964
Feedback
Did this article help you?

Thank you for your feedback!

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support


To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.


Need More Help?

Create a technical support case if you need further support.