Endpoints "Not Seen"

  • 18 June 2015
  • 7 replies

I have 2 servers with Webroot that haven't been seen by the Webroot portal in 10 days. I tied into them to see what was going on. Webroot is still installed and running, and it appears to still be running scheduled scans. It has the correct keycode still. By all appearances it seems to be running correctly, but it can't communicate to the portal.

I issued an agent command to scan for testing purposes. I tried running "wrsa -poll" and I tried right-click (greater than) refresh configuration, but it hasn't resolved the issue and the scan command is still pending.

The desktops at this site are still checking in fine, and all my other sites appear to be fine as well.
Any ideas?

7 replies

Userlevel 7
Badge +56
First thing to check is the policy those servers are in.  If they aren't in the Recommended Server Defaults, then put them in that policy and then reboot the servers when you have a maintenance window.
Thank you for the response.  They are both in Recommended Server Defaults policy already, and have been for 2-3 months.  I am in contact with a Webroot rep now though who sent me something to collect logs, so I'm confident it will be able to be resolved.  If it ends up being something really simple I'll post back with the solution just for other users' reference.
Userlevel 7
Badge +56
Cool, glad you are working with support.  It looks like this issue has a couple root causes, as we fixed one of them but there are still some people having this problem.  There's one support guy in particular who is collecting info on these cases, so ask for @ if you aren't already working with him
As it turned out, a simple reboot fixed it.
Userlevel 4
@ we've also had this problem, but it seems to happen randomly on different servers on different days.  I've created a feature request to stop the servers having to be rebooted.  I really hop they fix it soon, as some of these servers need to be running 24/7 due to remote connections from different countries.
I have been working with support on this issue this week and in my scenario (RDS Servers) which may not be the same for everyone the reponse I have had is:
"As discussed, our development team have recently been made aware of the issue you are experiencing. What is happening is that the private bytes assigned to the WRSA.exe system process on some terminal servers is reaching 1.9GB and bottle-necking, causing performance issues.

The work around for now is to reboot the server when possible."
You can check this by running Process Hacker on the affected server. So support are aware of this issue, lets hope they fix it soon...
We are having the same issue.
We hope this will be fixed very soon because we cant restart the servers .