I frequently see the blackd engine re-initialize itself on just about every agent i've looked at. I've reported it to ISS on several occasions and it was reduced somewhat but is still definitely there. The Sentry (NIDS) seems to reinit whenever the gui is started (user log on), which is probably the cause of (2) below. Try removing the GUI from the startup folder. Remotely log on and see if the engine still did a reinit. Given the number of other problems with the software (we no longer bother to report most crashes and have recovery automated) I havent followed up further with on this one.
-Tom -----Original Message----- From: Vincent Fatica [mailto:[EMAIL PROTECTED] Sent: Saturday, September 06, 2003 3:17 PM To: [EMAIL PROTECTED] Subject: [ISSForum] Frequent BLACKD re-initializations Instead of going through the whole thing again, I'll reproduce below, a couple of recent postings to comp.security.firewalls. Basically the setup here is BI PCP 3.6 on XP SP1. Thanks! ... Vince First post: Here, the BI PCP 3.6 firewall frequently re-initializes itself ... stopping most threads, reading the inifiles, et c. Just in the last few hours, BLACKD.LOG shows several re-inits: 22:32:27 2003/09/05 22:32 56,079 blackd.log 22:32:42 2003/09/05 22:32 110,183 blackd.log 22:45:38 2003/09/05 22:45 165,557 blackd.log 22:51:54 2003/09/05 22:51 220,935 blackd.log 23:31:39 2003/09/05 23:31 276,313 blackd.log 23:52:55 2003/09/05 23:52 331,691 blackd.log 00:19:46 2003/09/06 0:19 387,069 blackd.log 00:23:02 2003/09/06 0:22 442,447 blackd.log BLACKD.LOG itself shows the re-initializations ... threads stopping, inifiles being read, adapters found, threads starting, et c., but gives no clue as to why its happening. I have seen other machines where this never happens. Here, it's troublesome for several reasons. It just shouldn't happen. When it does happen, BLACKD is very likely to leak another dozen thread handles (right not it has about 100 open thread handles ... only needs/uses about 12). And when one of these re-inits happens, EVD000.ENC gets overwritten on the next intrusion. In the few days I have played with BI, I have not been able to collect more than a few KB in an EVD file because it keeps doing this. Has anyone seen this? Does anyone know what causes it and how to fix it? Thanks. Second post: Let me try again. In the last hour, BLACKD has re-initialized itself 8 times. 11:41:42 2003/09/06 11:41 54,839 blackd.log 11:50:57 2003/09/06 11:50 110,231 blackd.log 11:53:48 2003/09/06 11:53 165,629 blackd.log 12:05:34 2003/09/06 12:05 221,031 blackd.log 12:35:04 2003/09/06 12:35 276,433 blackd.log 12:41:00 2003/09/06 12:40 331,835 blackd.log 12:43:00 2003/09/06 12:42 387,237 blackd.log 12:50:56 2003/09/06 12:50 442,639 blackd.log 12:51:46 2003/09/06 12:51 498,041 blackd.log In BLACKD.LOG, the end of an initialization looks like this: Sat, 06 Sep 2003 12:50:47: \Device\{8242C50C-36A7-40C0-BE0B-B3CC705D3117}.run() threadstart 47 That device is my "Local Area Connection", an onboard "Intel(R) PRO/1000 MT Network Connection". The beginning of the next init (the very next line in BLACKD.LOG) looks like this: Sat, 06 Sep 2003 12:51:34: /\Device\{8242C50C-36A7-40C0-BE0B-B3CC705D3117}run() THREADSTOP 47 This is followed by all threads stopping, inifiles read, and all threads starting again. So I must wonder what caused that thread to stop. This happens frequently, and ramdomly. But there are a couple of things I can do to make it happen: (1) start or stop a VPN connection (to another XP machine which BLACKD trusts). That's somewhat understandable since BLACKD discovers a new interface (or discovers that it's gone), namely, \Device\NdisWanIp. Bl ignores this device because of "adapter.enabled\Device\NdisWanIp=false" and doesn't start a thread to monitor it but it does "find" it when it's created and apparently becomes aware when it's terminated. Yet I don't understand the need to re-initialize all adapters. (2) when I start a remote desktop session (to the same trusted host mentioned above), BLACKD will re-init. This one I don't understand; no new interfaces/adapters appear. After termminating the RD session, possibly after several minutes, BLACKD will re-init again. Those are the two ways I can force a re-init but I'll say again that the re-inits also happen randomly, when I'm not doing anything ... for example, overnight, with no VPN's or RD sessions going. As for the leaking of thread handles on every re-initialization (I'm up to 66 right now according to ProcessExplorer), that's probably just a programming error (not freeing the handle when it's no longer needed). Memory usage suggests that there aren't really that many threads running, just old, unfreed handles. My biggest gripe about these re-inits is that when one occurs, EVD000.ENC is over-written on the next intrusion. I'd appreciate any info on this re-initialization business. And in particular, I wonder if there are any settings that will make BI handle VPNs and RD sessions more gracefully. _______________________________________________ ISSForum mailing list [EMAIL PROTECTED] TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo _______________________________________________ ISSForum mailing list [EMAIL PROTECTED] TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo
