Home Server

AV in WebTier

edited February 2009 in Server
I have a report server that's been running for several months with no
problems. All of a sudden this morning, all web clients are getting an AV
in their browser window that shows the following:

Access violation at address 01890DBD in module myWebTier.dll Read of address
00000000

The web tier has not changed in 6 months. It's an ISAPI dll.

The symptoms are this:

Client goes to report web site.
Login page is displayed.
Enter username and password.
Report tree is displayed.
When selecting a folder from the tree, report directory is displayed.
When selecting a report, the above error appears on all reports.

I'm not doing any logging on the webTier, so I can't refer to that. I
cleared out the Cache directory of all the session folders to see if that
would correct it. Here is a snippet from the server log:

"20090220 12:59:28:117","Session
Start",seInformation,0,,,{E0CAB490-4D4E-4F71-B007-EE4D84EE884F}
"20090220 12:59:28:117","Validate session parameters
request",seServiceRequest,1009,ValidateSessionParameters,"Session
Service",{E0CAB490-4D4E-4F71-B007-EE4D84EE884F}
"20090220 12:59:28:117","Validate session parameters
response: -1",seServiceResponse,1033,ValidateSessionParameters,"Session
Service",{E0CAB490-4D4E-4F71-B007-EE4D84EE884F}
"20090220 12:59:28:117","Validate session parameters
request",seServiceRequest,971,ValidateSessionParameters,"Session Service",
"20090220 12:59:28:133","Validate session parameters
response: -1",seServiceResponse,995,ValidateSessionParameters,"Session
Service",
"20090220 12:59:28:133","Session
Start",seInformation,0,,,{890CAAAA-61E5-4187-96AC-406D91DAC572}
"20090220 12:59:28:133","Request volume
names",seServiceRequest,997,GetVolumeNames,"Report
Catalog",{890CAAAA-61E5-4187-96AC-406D91DAC572}
"20090220 12:59:28:133","Send volume
names",seServiceResponse,947,GetVolumeNames,"Report
Catalog",{890CAAAA-61E5-4187-96AC-406D91DAC572}
"20090220 12:59:28:133","Request directory: Report
Choices",seServiceRequest,1041,GetVolumeDirectory,"Report
Catalog",{890CAAAA-61E5-4187-96AC-406D91DAC572}
"20090220 12:59:28:226","Send directory: Report
Choices",seServiceResponse,1731,GetVolumeDirectory,"Report
Catalog",{890CAAAA-61E5-4187-96AC-406D91DAC572}
"20090220 12:59:37:601","Session
End",seInformation,0,,,{E0CAB490-4D4E-4F71-B007-EE4D84EE884F}

We've re-installed the IIS on the server in hopes that something in there
was corrupt, but that didn't help. I saw a previous post from 2006 that
indicated that he was having the same problem, but your response was that
you had never seen that before. We have rebooted the server several times.
I don't have a clue as to what to try next. Any thoughts? RB 7.04.

Comments

  • edited February 2009

    Try to determined what has changed. Perhaps windows update ran and changed
    something? Perhaps some software some AntiVirus or other security software
    was installed? Or a firewall? Did you change the default printer driver for
    the account?

    Here is a story from another customer. (I do not know why this would cause a
    problem, but thought I would pass this along).

    "Somebody installed .NET Framework 3.0/3.5 on one of the report servers
    which includes the XPS Extension Pack which updates the existing universal
    print drivers (unidrv.dll, etc) in the spool directory. We thought something
    like that was the problem but when we removed 3.0 the problem was still
    there. Seems the XPS Extension Pack cannot be uninstalled without resorting
    to 3rd party removal tools. What we did to fix the problem was Disable
    Print Spooling service on the report servers which allows the PDF reports to
    be generated without the XPS/universal print drivers. "

    My other thought is that you could also try testing with RB 11.03. You would
    need to rebuild the server and webtier becausee they need to use the same
    version.



    --
    Nard Moseley
    Digital Metaphors
    www.digital-metaphors.com

    Best regards,

    Nard Moseley
    Digital Metaphors
    www.digital-metaphors.com
  • edited August 2009
    Samething occured for me. my logs says that "weException". We installed
    ESET couple of weeks ago but we are getting 3 days a while. I disabled spool
    service but nothing happened. I am using 10.07

    Regards.

This discussion has been closed.