Alert causes Reaper service to crash.

Document ID : KB000031724
Last Modified Date : 14/02/2018
Show Technical Document Details

Problem:   

When I setup an alert in NFA the reaper service stops and don't start until I delete the Alert.

Flow alert on all interfaces causes Reaper service to stop and will not start and create application error until the alert has cleared from the harvester.trap_definitions table.
 

Environment:  

Win 2008 R2, Win 2012 R2
 
NFA 9.3.1.77
NFA 9.3.3.11
 

Cause: 

Creating an alert that includes all interfaces (interface group) based on no flow for 1 minute.

Result - Reaper service will crash with no messages in the realtime reaper log. Trying to start the reaper will just continue to crash with the below errors in the application log: 

Errors on startup application log:
 
Faulting application name: nfrtreaper.exe, version: 0.0.0.0, time stamp: 0x554293a9
Faulting module name: nfrtreaper.exe, version: 0.0.0.0, time stamp: 0x554293a9
Exception code: 0xc0000005
Fault offset: 0x000000000017ea95
Faulting process id: 0xaf4
Faulting application start time: 0x01d0dec667b9fb6b
Faulting application path: C:\CA\NFA\netflow\bin\nfrtreaper.exe
Faulting module path: C:\CA\NFA\netflow\bin\nfrtreaper.exe
Report Id: a5c3ab71-4ab9-11e5-80aa-00505686368b
 
Details:
 
Log Name:      Application
Source:        Application Error
Date:          8/24/2015 7:41:32 PM
Event ID:      1000
Task Category: (100)
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      Computer2076
Description:
Faulting application name: nfrtreaper.exe, version: 0.0.0.0, time stamp: 0x554293a9
Faulting module name: nfrtreaper.exe, version: 0.0.0.0, time stamp: 0x554293a9
Exception code: 0xc0000005
Fault offset: 0x000000000017ea95
Faulting process id: 0xaf4
Faulting application start time: 0x01d0dec667b9fb6b
Faulting application path: C:\CA\NFA\netflow\bin\nfrtreaper.exe
Faulting module path: C:\CA\NFA\netflow\bin\nfrtreaper.exe
Report Id: a5c3ab71-4ab9-11e5-80aa-00505686368b
Fault bucket , type 0
Event Name: APPCRASH
Response: Not available
Cab Id: 0
 
Problem signature:
P1: nfrtreaper.exe
P2: 0.0.0.0
P3: 554293a9
P4: nfrtreaper.exe
P5: 0.0.0.0
P6: 554293a9
P7: c0000005
P8: 000000000017ea95
P9: 
P10: 
 

Resolution/Workaround: 

Slated to be fixed in NFA 9.3.3.16.  

The current workaround is to make sure that flow setting is not set to zero.

  

Additional Information:

Defect DE47680