4

We're using OpsView/Nagios to monitor our servers. We've added the SNMP service to all our servers and deployed the configuration via GPO, but one win2k3 server seems to have a problem; it crashes pretty regularly. The event log carries messages like:

Event Type: Error
Event Source:   Service Control Manager
Event Category: None
Event ID:   7034
Date:       6/11/2009
Time:       7:11:49 PM
User:       N/A
Computer:   HOSTNNAME
Description:
The SNMP Service service terminated unexpectedly.  It has done this 2 time(s). 

and also

Event Type: Error
Event Source:   Application Error
Event Category: (100)
Event ID:   1000
Date:       6/11/2009
Time:       7:11:18 PM
User:       N/A
Computer:   HOSTNAME
Description:
Faulting application snmp.exe, version 5.2.3790.3959, faulting module ntdll.dll, 
version 5.2.3790.3959, fault address 0x000417af.

Now, I could probably set it to simply restart on crash in perpetuity, but I think it's better to fix problems like this. Is this a known problem? If not, what should I do to diagnose it?

jldugger
  • 14,342
  • 20
  • 77
  • 129

3 Answers3

6

I had this type of issue before. Check for SNMP agent extension. Dell and others add extensions to the SNMP service, and may cause a crash due to missing DLL & co.

I blogged about it, that was Arcserve the guilty at this time

Compare this hive with others servers:

HKLM\SYSTEM\CurrentControlSet\Services\SNMP\Parameters\ExtensionAgents

You may also use Process Explorer to track SNMP service behavior.

I say Reinstate Monica
  • 3,132
  • 7
  • 28
  • 52
Mathieu Chateau
  • 3,185
  • 16
  • 10
5

I also had a similar problem and Mathieu's solution helped me. In my case there was a registry with the following name .

"aussnmp"="SOFTWARE\\Adaptec\\RAIDController\\AAC\\CurrentVersion"

Deleting this solved the problem.

Btw, this is on Windows Server 2008 R2 enterprise on DELL hardware.

user70410
  • 706
  • 5
  • 4
  • HKEY_LOCAL_MACHINE\SOFTWARE\Adaptec\RAIDController\AAC\CurrentVersion\Pathname Deleting this key helped me –  Dec 24 '12 at 02:28
  • @user70410, I navigated to a similar registry value: "Pathname"="C:\\Program Files\\Adaptec\\Adaptec Storage Manager\\aus-snmp.dll" Deleting this solved my problem. Thanks! – northben Apr 09 '12 at 22:11
1

I've had some intermittent issues with this same thing on physical SuperMicro servers at SoftLayer. I found deleting both the following keys seems to fix the issue.

HKEY_LOCAL_MACHINE\SOFTWARE\Adaptec\RAIDController\AAC\CurrentVersion\aussnmp 
HKEY_LOCAL_MACHINE\SOFTWARE\Adaptec\RAIDController\AAC\CurrentVersion\Pathname
token
  • 275
  • 1
  • 3
  • 9