mirror of
https://github.com/amidaware/tacticalrmm.git
synced 2026-04-27 07:25:56 +03:00
[GH-ISSUE #331] Script monitors ocassionally failing #2157
Labels
No labels
In Process
bug
bug
dev-triage
documentation
duplicate
enhancement
fixed
good first issue
help wanted
integration
invalid
pull-request
question
requires agent update
security
ui tweak
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/tacticalrmm#2157
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @sdm216 on GitHub (Mar 17, 2021).
Original GitHub issue: https://github.com/amidaware/tacticalrmm/issues/331
Since 0.4.24 (Which actually fixed this same issue happening all the time), agents are still occasionally getting the alert below with script checks failing. Repairing the Tactical Agent through Agent Recovery seems to temporarily fix it. With about 200 agents, it's happening about 3-5 devices a day, at random times throughout the day. It keeps failing until the agent is "recovered".
CompanyName, SiteName DeviceName - Script Check: Script Name Failed - Return code: 85
Stdout:
Stderr: open C:\WINDOWS\TEMP\trmm\198018948.ps1: The system cannot find the path specified.
@dinger1986 commented on GitHub (Mar 17, 2021):
Have you created the exclusions in your AV?
@sdm216 commented on GitHub (Mar 17, 2021):
Yep. I use Defender, and checked the defender event logs, and it isn't blocking anything. And it all works again after recovering the agent, at least for a while.
@dinger1986 commented on GitHub (Mar 17, 2021):
Ok. That's interesting I have afew machines that do that as well but always seems to be when they are under load and then it runs fine next time
@sdm216 commented on GitHub (Mar 17, 2021):
It seems like the script is being deleted from the temp folder, and the agent isn't automatically re-downloading it until it's recovered. The most recent one was actually not too long after a reboot.
Edit: which makes sense, if Windows empties the temp folder after a reboot. But it just keeps failing until the agent is recovered, so maybe the agent needs to know to re-download the script if it isn't there already.
@dinger1986 commented on GitHub (Mar 17, 2021):
The way the scripts work in my understanding is they are downloaded and ran each and every time.
When you said you checked defender logs did you check in event viewer?
@sdm216 commented on GitHub (Mar 17, 2021):
Yeah, under Applications & Service Logs> Microsoft > Windows > Windows Defender > Operational. I monitor this log for the events indicating it found something, but I did check manually as well.
@sdm216 commented on GitHub (Mar 17, 2021):
Should also note I have all Attack Surface Reduction Rules enabled, but again, it isn't logging that it blocked anything, which it would if it was.
@dinger1986 commented on GitHub (Mar 17, 2021):
Ok that's fine, just making sure, like I said I have noticed it. I'll keep an eye on it. @wh1te909 have you seen this happening on your machines?
@wh1te909 commented on GitHub (Mar 17, 2021):
ive had this happen only once on 1 agent since I released the fix for the original but. Seems something is deleting the
trmmfolder in C:\Windows\TEMP.The agent creates this directory everytime the
tacticalagentwindows service starts up, which is why doing a recovery fixes it cuz part of the recovery is to restart that service.I've fixed this already here
github.com/wh1te909/rmmagent@67a8ab822cwhich will just create the directory if it doesn't exist right before running a script. It will be in the next agent release@wh1te909 commented on GitHub (Mar 19, 2021):
Fixed in 0.4.27 / agent 1.4.13