05-19-2020 10:03 PM
I'm getting repeated BSODs, and it appears to be due to some weirdness between my VPN client and the NationalInstruments.TagService.exe.
Specifically, in the crash dump it appears that the Tag Service exe is calling in to the vsdatant.sys driver (part of the Check Point End Point Security / VPN client).
Partial crash dump analysis:
PROCESS_NAME: NationalInstruments.TagService.exe BAD_STACK_POINTER: ffff9b0026eff088 STACK_TEXT: ffff9b00`26eff088 fffff807`1d8a6987 : 00000000`0000001e ffffffff`c0000005 fffff807`2b5b0f19 ffffd30d`025047f8 : nt!KeBugCheckEx ffff9b00`26eff090 fffff807`1d7dcd56 : fffff807`2b5b0f19 fffff807`1d65a1ab ffffd30d`02504a30 ffff9b00`26eff930 : nt!KiFatalFilter+0x1f ffff9b00`26eff0d0 fffff807`1d79d379 : fffff807`00000002 ffffd30d`02506570 ffffd30d`02501000 ffffd30d`02508000 : nt!KeExpandKernelStackAndCalloutInternal$filt$0+0x16 ffff9b00`26eff110 fffff807`1d7cb17f : ffffd30d`02506570 ffff9b00`26eff6f0 00000000`00000000 00000000`0010001f : nt!_C_specific_handler+0xa9 ffff9b00`26eff180 fffff807`1d6fa2c5 : 00000000`0000025d 00000000`00000000 ffff9b00`26eff6f0 00007fff`ffff0000 : nt!RtlpExecuteHandlerForException+0xf ffff9b00`26eff1b0 fffff807`1d6fe85e : ffffd30d`025047f8 ffff9b00`26effe30 ffffd30d`025047f8 ffffde8b`16feb8a0 : nt!RtlDispatchException+0x4a5 ffff9b00`26eff900 fffff807`1d7c3202 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDispatchException+0x16e ffff9b00`26efffb0 fffff807`1d7c31d0 : fffff807`1d7d4316 00000000`00000000 ffffd30d`025046d0 00000000`00001002 : nt!KxExceptionDispatchOnExceptionStack+0x12 ffffd30d`025046b8 fffff807`1d7d4316 : 00000000`00000000 ffffd30d`025046d0 00000000`00001002 00000000`00000001 : nt!KiExceptionDispatchOnExceptionStackContinue ffffd30d`025046c0 fffff807`1d7d00a0 : 00000000`00000002 00000000`00000768 00000000`00000110 00000000`00000000 : nt!KiExceptionDispatch+0x116 ffffd30d`025048a0 fffff807`2b5b0f19 : 00000000`00000001 00000000`00000002 ffffd30d`02504dc8 ffffde8b`16feb8a0 : nt!KiGeneralProtectionFault+0x320 ffffd30d`02504a30 00000000`00000001 : 00000000`00000002 ffffd30d`02504dc8 ffffde8b`16feb8a0 00000000`00010100 : vsdatant+0x10f19 ffffd30d`02504a38 00000000`00000002 : ffffd30d`02504dc8 ffffde8b`16feb8a0 00000000`00010100 ffffde8b`16b108a0 : 0x1 ffffd30d`02504a40 ffffd30d`02504dc8 : ffffde8b`16feb8a0 00000000`00010100 ffffde8b`16b108a0 ffffde8b`06e699a0 : 0x2 ffffd30d`02504a48 ffffde8b`16feb8a0 : 00000000`00010100 ffffde8b`16b108a0 ffffde8b`06e699a0 fffff807`2b5b5087 : 0xffffd30d`02504dc8 ffffd30d`02504a50 00000000`00010100 : ffffde8b`16b108a0 ffffde8b`06e699a0 fffff807`2b5b5087 fffff807`2b629918 : 0xffffde8b`16feb8a0 ffffd30d`02504a58 ffffde8b`16b108a0 : ffffde8b`06e699a0 fffff807`2b5b5087 fffff807`2b629918 00000000`00989680 : 0x10100 ffffd30d`02504a60 ffffde8b`06e699a0 : fffff807`2b5b5087 fffff807`2b629918 00000000`00989680 00000000`00000000 : 0xffffde8b`16b108a0 ffffd30d`02504a68 fffff807`2b5b5087 : fffff807`2b629918 00000000`00989680 00000000`00000000 ffffde8b`068bdc01 : 0xffffde8b`06e699a0 ffffd30d`02504a70 fffff807`2b629918 : 00000000`00989680 00000000`00000000 ffffde8b`068bdc01 00000000`00010100 : vsdatant+0x15087 ffffd30d`02504a78 00000000`00989680 : 00000000`00000000 ffffde8b`068bdc01 00000000`00010100 fffff807`2b5b2f5d : vsdatant+0x89918 ffffd30d`02504a80 00000000`00000000 : ffffde8b`068bdc01 00000000`00010100 fffff807`2b5b2f5d 00000000`00989680 : 0x989680 SYMBOL_NAME: vsdatant+10f19 MODULE_NAME: vsdatant IMAGE_NAME: vsdatant.sys STACK_COMMAND: .thread ; .cxr ; kb BUCKET_ID_FUNC_OFFSET: 10f19 FAILURE_BUCKET_ID: 0x1E_c0000005_STACKPTR_ERROR_vsdatant!unknown_function OS_VERSION: 10.0.18362.1 BUILDLAB_STR: 19h1_release OSPLATFORM_TYPE: x64 OSNAME: Windows 10 FAILURE_ID_HASH: {29dfa90a-0804-1c92-0b00-eaed1d0d7198} Followup: MachineOwner
Has anyone else reported an issue and/or incompatibility of this nature?
Solved! Go to Solution.
05-19-2020 11:11 PM
Hey Chris,
Nice handle 🙂 I've not heard of this issue being reported. The TagService isn't really calling vsdatant.sys directly as much as it's using the network stack (which the VPN is embedded into). Searching into BSODs and vsdatant.sys seems to indicate a problem with ZoneAlarm. Does that software exist?
https://www.windowstechit.com/259/solved-windows-7-64-bit-bsod-errors-simple-solutions/
https://www.tenforums.com/bsod-crashes-debugging/91992-bsod-after-installing-checkpoint-vpn.html
When did this start occurring?
Anything update recently or was it ever since TagService was installed?
Thanks,
Ryan F
05-20-2020 08:34 AM
Sorry, I should have been more clear; I assumed it was a network stack issue and not a direct call.
It started occurring right after the Check Point VPN client was installed (which either shares some dependencies with Zone Alarm or uses it directly). I'm not necessarily pointing my finger at SystemLink as the guilty party, but something about the way it interfaces with the vsdatant driver seems to be causing it, even if that's just exposing a latent bug in said driver.
Worth noting, these happen relatively frequently (2-3/day) and it seems to be consistently the same basic cause... TagService crashing after a call to the vsdatant.sys driver.
The only things I currently have installed with "SystemLink" in the name are the LabVIEW SystemLink Toolkit and the NI SystemLink Client. Would uninstalling those two packages get rid of the TagService, or is it integrated more deeply?
05-20-2020 10:24 AM
The Tag Service doesn't install with the LabVIEW SystemLink Toolkit or the NI SystemLink Client. Those are the client side components that typically connect remotely to an external SystemLink Server that would be hosting the Tag Service.
However, the NI Tag Service does install with FlexLogger and the NXG Web Module. Both of them use it internally for storing data, so they would need to be uninstalled for it to be removed. You can also open the NI Package Manager and use the gear icon in the upper right to show the infrastructure components and then search for Tag Service in the list of installed software. If you try to uninstall it, NIPM will show you what depends on it and will need to be removed.
05-20-2020 10:25 AM
FWIW, my IT department just downgraded me from the "Endpoint Security VPN" to the "Check Point Mobile" VPN, and vsdatant.sys no longer seems to be on my drive. Hopefully that clears things up, which makes my prior question about what uses the tag service no longer relevant.
05-20-2020 10:29 AM
@JoshuaP wrote:
The Tag Service doesn't install with the LabVIEW SystemLink Toolkit or the NI SystemLink Client. Those are the client side components that typically connect remotely to an external SystemLink Server that would be hosting the Tag Service.
However, the NI Tag Service does install with FlexLogger and the NXG Web Module. Both of them use it internally for storing data, so they would need to be uninstalled for it to be removed. You can also open the NI Package Manager and use the gear icon in the upper right to show the infrastructure components and then search for Tag Service in the list of installed software. If you try to uninstall it, NIPM will show you what depends on it and will need to be removed.
Oops, my bad. I saw it in the Skyline directory and searched for "Skyline" in NIPM, which only displayed things with "SystemLink" in the name. I removed the web module quite some time ago, but I'm guessing it's just a remnant. Regardless, fingers crossed that the downgrade fixed it.
05-21-2020 09:42 AM
Update for posterity: 24-hours without a BSOD, so removing the security suite seems to have resolved the issue.