ES530EPAgentWX64005

Hotfix package name: ES530EPAgentWX64005.zip
For: EdgeSight for Endpoints Agents running on 64-bit editions of one of the following operating systems, with or without EdgeSight software being previously installed:

• Windows XP
• Windows Vista
• Windows 7

Replaces: All previous versions
Date: December, 2014
Languages supported: English (US), German (DE), Spanish (ES), French (FR), Japanese (JA)
Readme version: 1.00

Readme Revision History

Version	Date	Change Description
1.00	December, 2014	Initial release

Important Note(s)

Caution! This release may require you to edit the registry. Using Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Citrix cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk.

Where to Find Documentation

This document describes the issue(s) resolved by this release and includes installation instructions. For additional product information, see Citrix Knowledge Center.

New Fixes in This Release

1. For agents running on PVS provisioned XenApp servers, the Device Reboot alert can fail due to non-persistent storage locations of the Windows System Event log. To enable this fix, the Window System Event log must be written to persistent storage.

   Important: Along with installing this fix, you must set up the Windows System Event log of each provisioned XenApp server in a permanent storage location.

   [From ES530EPAgentWX64005][#LA4124]

2. When configuring EdgeSight alerts with the poll interval set to 270 seconds, the first two alerts might occur every 270 seconds but subsequent alerts occur every 360 seconds.

   [From ES530EPAgentWX64005][#LA4339]

3. Time changes in the Virtual Desktop Agent causes errors in the EdgeSight Agent payload processing.

   [From ES530EPAgentWX64005][#LA4593]

4. The EdgeSight Agent Service (RsCorSvc.exe; Citrix System Monitoring Agent) might exit unexpectedly and the error is recorded in the sys_event_txt.txt log.

   [From ES530EPAgentWX64005][#LA4621]

5. This fix addresses a non-paged pool memory issue that occurs when EdgeSight falls behind in processing the collection of Windows event logs. This fix introduces support for the following registry key, which allows you to completely turn off the collection of Windows event logs. One consequence of turning off the collection of Windows event logs is that EdgeSight alert rules that are based on event IDs will not work. After installing this fix but before using this method, create an Agent property to suppress security event logging (and if necessary also to reduce or suppress system/application event logging).

   To enable the fix, set the following registry key:

   HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Citrix\System Monitoring\Agent\Core\4.00
   Name: DisableEventLogging
   Type: REG_DWORD
   Value: 1 (disable); 0 (reenable)

   [From ES530EPAgentWX64005][#LA5284]

6. If EdgeSight is disabled by using the UI setting, starting the application can cause an infinite load or unload loop. This can slow the process start time because the CPU consumption is high.

   [From ES530EPAgentWX64005][#LA5461]

7. The EdgeSight Agent Service (rscorsvc.exe; Citrix System Monitoring) might exit unexpectedly if the partition has a corrupt transaction.

   [From ES530EPAgentWX64005][#LA5760]

8. This feature enhancement updates the SQL API in EdgeSight from Version 3.x to Version 4.1.3 and improves stability while accessing the database.

   [From ES530EPAgentWX64005][#LC0154]

Fixes from Replaced Hotfixes

1. When an EdgeSight Agent upgrade is performed using the MSIEXEC command line, some registry values may be corrupted and the System Monitoring Service will not start.

   [From ES530EPAgentWX64001][#234109]

2. Session Performance alerts are not generated when the poll interval selected is 360 seconds.

   [From ES530EPAgentWX64002][#234266]

3. If the scheduled job for daily data deletion and the database maintenance worker run at the same time, the EdgeSight Agent hangs and is restarted.

   [From ES530EPAgentWX64002][#239632]

4. Large amounts of data were generated when monitoring Windows Event Log alerts. Event log alert data can be throttled using registry keys located at HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\System Monitoring\Agent\EdgeSight\4.00. There is one registry key per event log (System, Application, and Security). The registry key type is DWORD.

   • MaxSysEventLogThreshold
   • MaxAppEventLogThreshold
   • MaxSecEventLogThreshold

   Specify a value to indicate the maximum number of event log messages allowed per 10 minute window. Event log alerts can be throttled to zero. Any missing value will be considered as unlimited, meaning that no throttling will be applied to alerts for the corresponding event log.

   This feature is only included in EdgeSight 5.3. In future releases, the registry key will be ignored and an equivalent function will be available from the EdgeSight Server console.

   [From ES530EPAgentWX64002][#240693]

5. The XenApp server was slow to restart or logoff after upgrading the HP System Management Homepage to version 6.1.0.102.

   [From ES530EPAgentWX64002][#241240]

6. Thread Hang Detection is tripped repeatedly resulting in an error messages ("The queue thread has stopped responding" or "The Scheduler thread has stopped responding") and a restart of the EdgeSight agent.

   [From ES530EPAgentWX64002][#242581]

7. The EdgeSight Agent Service (rscorsvc.exe; Citrix System Monitoring Agent) is terminated unexpectedly.

   [From ES530EPAgentWX64002][#245683]

8. The EdgeSight Agent service (rscorsvc.exe) experiences memory leaks.

   [From ES530EPAgentWX64002][#245749]

9. Version 5.3 (or 5.3, Build 4109) of the EdgeSight Agent can exit unexpectedly with the following error: "INVALID_POINTER_READ_c0000005_es_ext.dll!CProcessCounterSet::IterThreads."

   [From ES530EPAgentWX64003][#242580]

10. Published application information is not collected when the application is launched from a script, for example a file with .cmd extension. This fix is dependent on the installation of hotfix EUEM100W001, which addresses the underlying EUEM issue for Windows Server 2003 32-bit and 64-bit systems.

    [From ES530EPAgentWX64003][#244070]

11. When launching certain applications, a C++ Runtime Initialization Error may occur which prevents the application from launching.

    This is caused by processes that dynamically link to the same runtime components of Visual C++ libraries as the EdgeSight Agent. In order to avoid this problem, the conflicting processes need to be excluded from EdgeSight monitoring by using the registry keys listed below.

    By default all processes are monitored.

    To exclude specific processes:

    1. Add a list of processes to be excluded from being monitored by EdgeSight (separate the processes by a semi-colon) to the UviProcessList registry key.
    2. Set the UviProcessIsExcluded registry key to 1 to exclude the processes in the list:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rskcore
    Name: UviProcessList
    Type: REG_SZ
    Data: <semi-colon separated list of processes to exclude>

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rskcore
    Name: UviProcessIsExcluded
    Type: REG_DWORD
    Data: 1 (to exclude the listed processes from being monitored, this is set to 1 by default)

    This enhancement extends the agent??????s functionality by providing the option to monitor only specific processes and exclude all others.

    To monitor only specific processes:

    1. Add a list of processes to be monitored by EdgeSight (separate the processes by a semi-colon; do not include any leading spaces in process names) to the UviProcessList registry key.
    2. Set the UviProcessIsExcluded registry key to 0 to include the processes in the list:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rskcore
    Name: UviProcessList
    Type: REG_SZ
    Data: <semi-colon separated list of processes to monitor>

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rskcore
    Name: UviProcessIsExcluded
    Type: REG_DWORD
    Data: 0 (to include the listed processes to be monitored)

    Note:

    Applying this fix deprecates the following registry key. During the upgrade its values are migrated to the new UviProcessIsExcluded key:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rskcore\UviProcessExcludes

    [From ES530EPAgentWX64003][#248309]

12. The EdgeSight Agent Service (rscorsvc.exe; Citrix System Monitoring Agent) can exit unexpectedly, causing sessions running on XenApp servers to be disconnected at random several times a day. The following error message appears:

    "The Citrix System Monitoring Agent service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service."

    [From ES530EPAgentWX64003][#259762]

13. The EdgeSight Agent Service (rscorsvc.exe; Citrix System Monitoring Agent) can restart unexpectedly due to a defect in the ZCollect!ProcessTracker::PersistUsage module. The restart generates a rscorsvc.exe.dmp file.

    [From ES530EPAgentWX64003][#LA0207]

14. The EdgeSight Agent Service (rscorsvc.exe; Citrix System Monitoring Agent) can restart unexpectedly due to a defect in the QRThread (thread#4 ZCollect!QThread::FindPrincipal called by winsta!RpcWinStationGetAllProcesses_NT6). The restart generates a rscorsvc.exe.hang.dmp file.

    [From ES530EPAgentWX64003][#LA0208]

15. This fix addresses several instances where the EdgeSight Agent Service (rscorsvc.exe; Citrix System Monitoring Agent) can restart unexpectedly due to a defect in the ZCollect!ProcessTracker::Find module. The restart generates a rscorsvc.exe.dmp file.

    [From ES530EPAgentWX64003][#LA0245]

16. The EdgeSight Agent Service (rscorsvc.exe; Citrix System Monitoring Agent) can restart unexpectedly or can appear to be non-functional while writing to the rscorsvc.exe.hang.dmp file due to a defect in the ZCollect module. The restart generates a rscorsvc.exe.hang.dmp file.

    Another symptom might be that the EdgeSight Agent stops working (the time when the last entry was made in SYS_EVENT_TXT.txt exceeds one hour) and a rscorsvc.exe.hang.dmp file with zero bytes is created.

    [From ES530EPAgentWX64003][#LA0355]

17. EdgeSight's asset worker invokes a WMI query to the win32_Product class. The query invokes a consistency check on each installed MSI package. The consistency check generates a Windows Application Event log entry for each installed MSI package that passes the test, stating "Windows Installer reconfigured the product. Product Name: <name>." As a result, Windows Event logs are being populated with unnecessary events.

    After applying this fix, EdgeSight no longer performs the WMI query and the unnecessary log entries are no longer generated.

    [From ES530EPAgentWX64003][#LA0387]

18. Several processes, including explorer.exe, iexplore.exe, and cnthelp.exe, running on servers with the EdgeSight Agent installed can exit unexpectedly. The dump of a process shows that the EdgeSight RSIntCor module exited when trying to get version information (RSCorInt!ModInfo::getVersionInfo) for the program module.

    [From ES530EPAgentWX64003][#LA0769]

19. A generic rscorsvc.exe.dmp file is created for the EdgeSight Agent Service (rscorsvc.exe; Citrix System Monitoring Agent) for a variety of reasons.

    [From ES530EPAgentWX64003][#LA0921]

20. The EdgeSight Agent Service (rscorsvc.exe; Citrix System Monitoring Agent) can exit and then restart intermittently.

    [From ES530EPAgentWX64003][#LA1289]

21. The EdgeSight Agent Service (rscorsvc.exe; Citrix System Monitoring Agent) can restart unexpectedly with the following message in the sys_event-txt.txt file: "queue thread has stopped responding."

    A few thread activities might exceed the allowed fixed time (300 seconds) for processing, and the restart generates a rscorsvc.exe.hang.dmp file.

    This fix lets you modify the allowed fixed time beyond 300 seconds. To enable it, you must create the following registry key:

    On 32-bit Windows:

    HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\System Monitoring\Agent\Core\4.00
    Name: MaxQueuedSecs
    Type: REG_DWORD
    Data: <A value of 0x12c (300 seconds) to 0x384 (900 seconds); lower or higher data values are replaced (in code) by 300 and 900>

    On 64-bit Windows:

    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Citrix\System Monitoring\Agent\Core\4.00
    Name: MaxQueuedSecs
    Type: REG_DWORD
    Data: <A value of 0x12c (300 seconds) to 0x384 (900 seconds); lower or higher data values are replaced (in code) by 300 and 900>

    [From ES530EPAgentWX64003][#LA1478]

22. Real-time alerts that are configured for CPU times might fail when the polling interval exceeds 10 minutes.

    [From ES530EPAgentWX64003][#LA1706]

23. The EdgeSight Agent Service (rscorsvc.exe) can experience memory leaks.

    [From ES530EPAgentWX64003][#LA1796]

24. If you change user names in Active Directory, the changes are not reflected in the EdgeSight database.

    To enable this fix, you must also install EdgeSight server-side Fix #LA1243 (ES540ServerWX86002; ES540ServerWX64002 or their replacements).

    [From ES530EPAgentWX64004][#LA1506]

25. The EdgeSight Agent Service (rscorsvc.exe; Citrix System Monitoring Agent) can exit and then restart intermittently. The following errors are recorded:

    Error in sys_event_txt.txt log:
    "unavailableDB"

    Error in Firebird.log:
    "XNET error: get_free_slot() failed?????? or ??????unknown ISC error 0"

    [From ES530EPAgentWX64004][#LA1761]

26. The following error might be recorded in the sys_event_txt.txt log: "Unable to connect to database server RSDatr" and the administrator might be notified of a fatal database error. Also, an rscorsvc.exe.shutdown.dmp file might be created in the EdgeSight data folder. The issue usually occurs when there are connectivity issues with the Firebird Service. This fix lets you set the following registry key to configure a fault tolerance level for the number of database connectivity issues encountered before the error notifications are triggered:

    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Citrix\System Monitoring\Agent\Core\4.00
    Name: DatabaseMaxExceptionLevel
    Type: REG_DWORD
    Value: 2 (default) 3, 4, or 5 (Recommendation: Start with a value of 3)

    [From ES530EPAgentWX64004][#LA2705]

27. The EdgeSight Agent Service (rscorsvc.exe; Citrix System Monitoring) can restart unexpectedly due to processing of data while shutting down. The restart generates a rscorsvc.exe.shutdown.dmp file.

    [From ES530EPAgentWX64004][#LA2958]

28. Inclusion or exclusion of processes with names that contain more than 15 characters does not work correctly.

    This fix allows using process names up to 31 characters in length.

    [From ES530EPAgentWX64004][#LA2960]

29. The EdgeSight Agent Service (rscorsvc.exe; Citrix System Monitoring) can restart due to a defect with connections to an unresponsive database. The restart generates a rscorsvc.exe.hang.dmp.

    [From ES530EPAgentWX64004][#LA3077]

30. When starting the EdgeSight Agent Service (rscorsvc.exe; Citrix System Monitoring) after launching a session on a client device, the session display might become unresponsive.

    [From ES530EPAgentWX64004][#LA4032]

31. The EdgeSight Agent Service (rscorsvc.exe; Citrix System Monitoring) can restart unexpectedly while purging inactive sessions. The restart generates a rscorsvc.exe.dmp file.

    [From ES530EPAgentWX64004][#LA4125]

32. The EdgeSight Agent Service (rscorsvc.exe; Citrix System Monitoring Agent) can exit unexpectedly while the system shuts down or restarts.

    [From ES530EPAgentWX64004][#LA4130]

Installing This Release

Notes:

• This version is packaged as a .zip file containing the replacement EdgeSightEPAgentx64.msi file. For more information about deploying msi files, see Microsoft article 884016 or visit the Microsoft Web site and search on keyword msiexec.
• To install this version successfully, servers must not have registry modification restrictions in place.
• If you are installing this release on a non-English operating system and would like to display the UI in the applicable language, run the MSI file using the msiexec command and specify the language-specific MST file as the value for the TRANSFORMS argument. Each MST file name includes the two letter language code. For example: msiexec /I EdgeSightEPAgentx64.msi TRANSFORMS=:de_transform.mst??
• Notice to Administrators: this release contains the metadata.xml file for use in Citrix Receiver deployments.

To install this version:

1. Copy the file to a shared folder on the network.
2. Extract the compressed file and save the EdgeSightEPAgentx64.msi file on the computer you want to update.
3. Run the .msi file.
4. Restart the computer if prompted to do so.

If it does not exist already, this will add a new entry, Citrix EdgeSight for Endpoints Agent 5.3 x64, to the Add/Remove Programs list.