ePO Replication Issues

[pauldr]

Recently - about 1 month ago, we experienced a fault with the server responsible for running the ePO management console. It appeared as though someone or something had deleted the entire \winnt folder including all its subfolders. The only files left were those that were in use at the time. We immediately suspected a hack. Unfortunately, auditing for these system files was not switched on. We did so.
After about two days, it happened again. This time, we were able to pinpoint what was deleting the files... : NAREPL32.exe
The deletion was happening at precisely the time that the replication was schedule to retrieve the updates from the Internet. Network Associates have not been very helpful at all. I have not installed the ePO patch but this doesn't seem to address the issues we have witnessed. We are currently running updates manually.
Has anyone else seen this? Does anyone know of a solution?

Thanks,
Paul.

 

[moshefr]

Paul,


I'm having the same problem with a server. It's currently being looked into by NA.

I will update you as soon as I hear back.

BTW, expect it to happen again, it's intermittent.


Moshe

 

[moshefr]

The same problem happened to our server today, and I phoned NA again.

I was told this time that a possible cause my be the system variables TMP and TEMP not being specified, which in the case the ePO puts it's temporary files in C:\WINNT, which it then deletes...

It seem like those two system variables are not set up by default in NT4.

Set them up to point to C:\TEMP and make sure this folder exists.

Good luck!

 

[pauldr]

Moshe.
Thanks for this, you're about the only person that has acknowledged this as a problem. NAI were totally useless with their support on this. After several months of sending them info, they told me to rebuild the O.S. I will try this first thing on Monday morning and we'll see what happens. I can confirm that there are several hundred subfolders in /winnt which seem to be ePO related. This seems to tally with your description.

Thanks,
Paul.

 

[pauldr]

It's worth pointing out to others that if you have logged out of the system, the user environment variables are deleted. Please ensure that TEMP and TMP are system variables and set to a suitable temporary folder that is also available when nobody is logged in.

 

[moshefr]

I think that it's the combination of your and my complaints that made NAI take it a bit more seriously this time.

Letting their software use \WINNT as the default repository for temporary files is not very clever. If it couldn't find the system variable it should have used a folder under the application one. I'm sure they'll correct it.

Moshe

 

[Howlingmonkeyboy]

This is resolved in ePO 3.0 SP2a patch 6.