Events Dispatcher Service terminates unexpectedly

Version 1

    Introduction

    On rare occassions you may start seeing the AppSense Events Dispatcher Service terminating frequently, restarting the service does not resolve. In the event logs on the Management Server you will something similar to the below.

    .NET Runtime Error

    Application: EventsDispatcher.exe
    Framework Version: v4.0.30319
    Description: The process was terminated due to an unhandled exception.
    Exception Info: System.ArgumentException
    Stack:
    at EventsDispatcher.EventsDispatcher.TimedDirectorySearchThread(System.Object)
    at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
    at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
    at System.Threading.ThreadHelper.ThreadStart(System.Object)

    Application Error

    Faulting application name: EventsDispatcher.exe, version: 8.6.741.0, time stamp: 0x54456b6d
    Faulting module name: KERNELBASE.dll, version: 6.1.7601.19135, time stamp: 0x56a1c9ac
    Exception code: 0xe0434352
    Fault offset: 0x000000000000965d
    Faulting process id: 0x1d6c
    Faulting application start time: 0x01d1d1db00ab4829
    Faulting application path: D:\Program Files\AppSense\Management Center\Server\Bin\EventsDispatcher.exe
    Faulting module path: C:\Windows\system32\KERNELBASE.dll
    Report Id: 4012920e-3dce-11e6-a821-005056be16d1
    Faulting package full name: %14
    Faulting package-relative application ID: %15

    Detail

    The problem is often attributed to a corrupted Event file which is failing to upload and causing an exception to be thrown and the service to crash. To identify the Event file which could be causing the issue begin by gathering Event Dispatcher logs using the article below.

    Open these logs in a viewer such a Notepad or Notepad++, look for the name of the failing Event file such as the example below. The error will generally be at the end of the log file, just before the crash occurs.

    EXAMPLE: 

    CommonHelper.Logger 32: 0 : Watcher.UploadEventsToDatabase (C:\Program Files\AppSense\Management Center\Server\Web Site\Deployment\Events\78beaf95-e2c3-474a-8623-1476e13ce3a2\PWITA135-04-dec-2015-18-23-43-0.evt.gz)
    ProcessId=6652
    ThreadId=8
    CommonHelper.Logger Error: 0 : Exception System.IO.InvalidDataException: The magic number in GZip header is not correct. Make sure you are passing in a GZip stream.
    at System.IO.Compression.GZipDecoder.ReadHeader(InputBuffer input)
    at System.IO.Compression.Inflater.Decode()
    at System.IO.Compression.Inflater.Inflate(Byte[] bytes, Int32 offset, Int32 length)
    at System.IO.Compression.DeflateStream.Read(Byte[] array, Int32 offset, Int32 count)
    at System.IO.Compression.GZipStream.Read(Byte[] array, Int32 offset, Int32 count)
    at System.Xml.XmlTextReaderImpl.InitStreamInput(Uri baseUri, String baseUriStr, Stream stream, Byte[] bytes, Int32 byteCount, Encoding encoding)
    at System.Xml.XmlTextReaderImpl..ctor(String url, Stream input, XmlNameTable nt)
    at System.Xml.XmlTextReader..ctor(Stream input)
    at EventsDispatcher.Watcher.UploadEventsToDatabase(Database database, String filename, TimeSpan waitTime, TimeSpan retryTime)
    at EventsDispatcher.Watcher.UploadEventFile(String fullFilePath) caught in Watcher::UploadData() trying to upload
    ProcessId=6652
    ThreadId=8

    To resolve the issue start by disabling the AppSense Events Dispatcher service via the Management Server Configuration Utility, then navigate to the location of the Event file shown in the log. (In the case of the above example this would be "C:\Program Files\AppSense\Management Center\Server\Web Site\Deployment\Events\78beaf95-e2c3-474a-8623-1476e13ce3a2\PWITA135-04-dec-2015-18-23-43-0.evt.gz")

    Delete the folder with the unique GUI containing the Event file, such as "78beaf95-e2c3-474a-8623-1476e13ce3a2" in the above example, then restart the Events Dispatcher Service. This should resolve the issue and the Events Dispatcher Service should not longer terminate.