Title
#eclecticiq-polylogyx-extension
d

Dervon

04/20/2021, 9:14 AM
Can someone help me - I continue to test Polylogyx. I can say that on lightly loaded systems it works fine and even better than sysmon or something else that I have tried. But on heavily loaded systems, when I started testing in production, I saw the problem. The server crashed after 20 hours of work with polylogyx agent, and was not available by any means until I rebooted it. In errors, I encountered the following events
9:30 AM
@OpenPlgx Maybe you can help - I don’t know which way to dig anymore
o

OpenPlgx

04/20/2021, 9:35 AM
Can you manually stop the services?1. sc stop plgx_osqueryd 2. sc stop plgx_cpt 3. sc stop vast 4. sc stop vastnw
9:35 AM
Ignore any failures..but verify that all the services have stopped by running "sc query <svc_name>"
9:35 AM
You might have to wait 10-15 seconds..
9:36 AM
once all the services are stopped, try running only "sc start plgx_osqueryd" and lets see if everything comes back to normal
d

Dervon

04/20/2021, 9:55 AM
I had to reboot the server completely - since it did not answer and was not available on the Rdp
9:56 AM
after reboot - all back to normal. But half hour ago - second server with DC role got the same problem
9:57 AM
First server - 20 hours before crash Second server ~ 21
10:05 AM
@OpenPlgx maybe i can add this sequence for example to restart every 8 hours? maybe this can helpto avoid this problem. What you think?
o

OpenPlgx

04/20/2021, 1:35 PM
that can be one work around, yes
d

Dervon

04/20/2021, 2:52 PM
thank you sir - i will try