0

NetSetupSvc is a helper service for installing network drivers and managing low-level network settings. It is trigger-started via RPC and automatically stops after 3 seconds. During normal operation this service is never used. In my case it seems to only be triggered by backup and monitoring software.

On all HPE ProLiant servers I checked, I've noticed that the System log records the service starting and stopping every 6 minutes and 3 seconds, only to then start again a few seconds later. This generates around 500 extra log entries per day and quadruples the logging volume on these servers. This significantly reduces log retention (from 1y to 3mo) and clutters up the System log.

The cause here is the Agentless Management Service (AMS) which polls the system state every 2 minutes (10sec-10min configurable) so that the iLO BMC can display it and forward it on via SNMP. Among other things, it gathers MAC, ip/subnet, VLAN and port teaming information by querying WMI, which seems to use NetSetupSvc to answer these queries.

My ideas on how to deal with his:

  1. Prevent Network Setup Service from stopping when idle. - There is no documented way to do this. The service still stops even when set to Automatic start.
  2. Exclude Service Control Manager from log collection for System log. - This should be possible to do, somewhere, but it would completely silence all service activity, which may hinder troubleshooting of system issues.
  3. Disable Agentless Management Service. - Can be done if the monitoring features aren't needed. This causes a grey info box to display in various iLO menus.
  4. Get HPE to modify their monitoring software. - I could not find info if this lowlevel network state is obtainable in some other way.

This is mostly a flaw in Windows. Originally, services were always-on, and them starting and stopping during system operation was considered unusual and worth logging. Later, resource optimizations changed various services to manually start/stop via the task scheduler and via trigger events. This created logging noise and made troubleshooting inconvenient (without writing custom xml search filters). I have noticed that in Windows 11, the service start/stop log messages are completely gone.

theultramage
  • 413
  • 1
  • 5
  • 15

1 Answers1

0

Decompiling NetSetupSvc.dll!NetSetupService::Initialize() reveals that it checks "HKLM\System\CurrentControlSet\Control\NetworkSetup2\Parameters" for an optional setting 'NetSetupSvcIdleTimeout', and defaults to '3' if not found. If I use TrustedInstaller permissions to write this setting and set it to 0xffffffff, the service never stops. This is one way to solve it on the OS level, and this approach might be applicable to other services as well.

HPE support informed me that AMS has a bunch of optional undocumented registry settings under "Services\hpeams\Parameters". You can see them in the exe or via ProcMon at startup. The suggested one is 'EnableNetworkWatcher=0'. There is also 'EnableCPQNIC=0' with similar behavior. This allows turning off the problematic part and not have to disable the whole service.

AMS has a documented setting called 'PollInterval' which defaults to 120 seconds. Messing with this value reveals that the network polling runs on its own hardcoded 120-second timer and likely uses its own wmi handle, and WMI-Activity log reveals that the main loop accidentally leaves an wmi result set handle open. These two interleaving intervals seem to prevent NetSetupSvc from stopping if PollInterval is set to 110 or lower. This will work until that bug is fixed.

theultramage
  • 413
  • 1
  • 5
  • 15