topic TS-Agent problem in General Topics

TS-Agent problem

florianmoje — Tue, 04 Oct 2011 13:31:40 GMT

Hi,

we ve got a problem with the TS Agent on out terminalserver. After some time the TS Agent doesnt submit new users to the PA Device or the users submitted have a form error. Nomally the syntax is domain\username, but when the error occurs all submitted users have the syntax domain\domain (look at the logs below). Prior to this we can see some events in the logs like "User logoff on session xx with other session still exists". We can solve the problem by restartet the TS Agent... Some ideas? Thx

10/04/11 14:59:55[Info 1840]: User logoff on session 10 with other session still exist. <<-- is this correct?
10/04/11 15:00:06[Dump 1227]: Client thread 0 enum events 1!
10/04/11 15:00:06[Dump 1538]: Client thread 0 recv packet 2.
10/04/11 15:00:06[Dump 1573]: Client thread 0 SSL write msg 39 52 bytes!
10/04/11 15:00:06[Dump 1227]: Client thread 0 enum events 0!
10/04/11 15:00:27[Debug 211]: Session 1 notify type 3(Remote Connect).
10/04/11 15:00:27[Debug 635]: Receive session notify event.
10/04/11 15:00:28[Debug 211]: Session 1 notify type 5(Logon).
10/04/11 15:00:28[Debug 635]: Receive session notify event.
10/04/11 15:00:28[Debug 1669]: Session 1, username wmustermann.
10/04/11 15:00:28[Debug 1678]: Session 1, domain name DOMAIN.
10/04/11 15:00:28[Info 1705]: User DOMAIN\DOMAIN logon again with another session. <<-- wronmg syntax!
10/04/11 15:00:28[Info 1775]: User DOMAIN\DOMAIN logon finishes on session 1. <<-- should be DOMAIN\wmustermann!

PA has 4.05 with newest TS agent x64

Re: TS-Agent problem

dwhyte — Wed, 05 Oct 2011 18:50:52 GMT

- From the CLI, when the issue is happening, enter the following command from the CLI:show user ts-agent statistics. Verify that the TS Agent shows connect

- If is it does show that it is connected, then enter the command "show system resources". Hit the spacebar until you can see "devsrvr" and or "mgmtsrvr". Verify that the Virtual Memory is "Not" anywhere near 800m, if either of them is near that number then run the command "debug software restart device-server" or "debug software restart management-server". After you restart the "management-server", you will need to to log back into the CLI and the WebUI. This will not affect your user traffic.

- If this does not resolve your issue then call into support and any support engineer will be able to assist you

Re: TS-Agent problem

florianmoje — Thu, 06 Oct 2011 09:19:02 GMT

thx fot the answer, I checked the virtual devsrvr/mgmtsvr memory, it is about 200m, so far away from 800m. I think the problem is related to the ts-agent itselt. By restarting the service on the terminal server the problem is solved so far, but reoccurs again after some time.

Like I said, the ts-agent doesnt commit the correct username like DOMAIN/USERNAME instead it commits DOMAIN/DOMAIN to the firewall, what is denied. temporarely I created a task which restarts the agent server every 30 mins, but that cannot be definite solution.

I think the PA supports needs to look at this...

Re: TS-Agent problem

seniornwb — Fri, 29 Jun 2012 07:37:18 GMT

Hi,

Did you ever get this solved. We are experiencing the same issue (running ts agent 4.0.1-86)

I don't know if it is possible to run TS agent 4.1.0-11 against the 4.0.9 PAN-OS. Does anyone know if this is possible ?

Regards,

Hen