SystemLink

cancel
Showing results for 
Search instead for 
Did you mean: 

Apparent incompatibility with SystemLink and Check Point VPN/security client

Solved!
Go to solution
Highlighted

I'm getting repeated BSODs, and it appears to be due to some weirdness between my VPN client and the NationalInstruments.TagService.exe.

 

Specifically, in the crash dump it appears that the Tag Service exe is calling in to the vsdatant.sys driver (part of the Check Point End Point Security / VPN client).

 

Partial crash dump analysis:

 

PROCESS_NAME:  NationalInstruments.TagService.exe

BAD_STACK_POINTER:  ffff9b0026eff088

STACK_TEXT:  
ffff9b00`26eff088 fffff807`1d8a6987 : 00000000`0000001e ffffffff`c0000005 fffff807`2b5b0f19 ffffd30d`025047f8 : nt!KeBugCheckEx
ffff9b00`26eff090 fffff807`1d7dcd56 : fffff807`2b5b0f19 fffff807`1d65a1ab ffffd30d`02504a30 ffff9b00`26eff930 : nt!KiFatalFilter+0x1f
ffff9b00`26eff0d0 fffff807`1d79d379 : fffff807`00000002 ffffd30d`02506570 ffffd30d`02501000 ffffd30d`02508000 : nt!KeExpandKernelStackAndCalloutInternal$filt$0+0x16
ffff9b00`26eff110 fffff807`1d7cb17f : ffffd30d`02506570 ffff9b00`26eff6f0 00000000`00000000 00000000`0010001f : nt!_C_specific_handler+0xa9
ffff9b00`26eff180 fffff807`1d6fa2c5 : 00000000`0000025d 00000000`00000000 ffff9b00`26eff6f0 00007fff`ffff0000 : nt!RtlpExecuteHandlerForException+0xf
ffff9b00`26eff1b0 fffff807`1d6fe85e : ffffd30d`025047f8 ffff9b00`26effe30 ffffd30d`025047f8 ffffde8b`16feb8a0 : nt!RtlDispatchException+0x4a5
ffff9b00`26eff900 fffff807`1d7c3202 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDispatchException+0x16e
ffff9b00`26efffb0 fffff807`1d7c31d0 : fffff807`1d7d4316 00000000`00000000 ffffd30d`025046d0 00000000`00001002 : nt!KxExceptionDispatchOnExceptionStack+0x12
ffffd30d`025046b8 fffff807`1d7d4316 : 00000000`00000000 ffffd30d`025046d0 00000000`00001002 00000000`00000001 : nt!KiExceptionDispatchOnExceptionStackContinue
ffffd30d`025046c0 fffff807`1d7d00a0 : 00000000`00000002 00000000`00000768 00000000`00000110 00000000`00000000 : nt!KiExceptionDispatch+0x116
ffffd30d`025048a0 fffff807`2b5b0f19 : 00000000`00000001 00000000`00000002 ffffd30d`02504dc8 ffffde8b`16feb8a0 : nt!KiGeneralProtectionFault+0x320
ffffd30d`02504a30 00000000`00000001 : 00000000`00000002 ffffd30d`02504dc8 ffffde8b`16feb8a0 00000000`00010100 : vsdatant+0x10f19
ffffd30d`02504a38 00000000`00000002 : ffffd30d`02504dc8 ffffde8b`16feb8a0 00000000`00010100 ffffde8b`16b108a0 : 0x1
ffffd30d`02504a40 ffffd30d`02504dc8 : ffffde8b`16feb8a0 00000000`00010100 ffffde8b`16b108a0 ffffde8b`06e699a0 : 0x2
ffffd30d`02504a48 ffffde8b`16feb8a0 : 00000000`00010100 ffffde8b`16b108a0 ffffde8b`06e699a0 fffff807`2b5b5087 : 0xffffd30d`02504dc8
ffffd30d`02504a50 00000000`00010100 : ffffde8b`16b108a0 ffffde8b`06e699a0 fffff807`2b5b5087 fffff807`2b629918 : 0xffffde8b`16feb8a0
ffffd30d`02504a58 ffffde8b`16b108a0 : ffffde8b`06e699a0 fffff807`2b5b5087 fffff807`2b629918 00000000`00989680 : 0x10100
ffffd30d`02504a60 ffffde8b`06e699a0 : fffff807`2b5b5087 fffff807`2b629918 00000000`00989680 00000000`00000000 : 0xffffde8b`16b108a0
ffffd30d`02504a68 fffff807`2b5b5087 : fffff807`2b629918 00000000`00989680 00000000`00000000 ffffde8b`068bdc01 : 0xffffde8b`06e699a0
ffffd30d`02504a70 fffff807`2b629918 : 00000000`00989680 00000000`00000000 ffffde8b`068bdc01 00000000`00010100 : vsdatant+0x15087
ffffd30d`02504a78 00000000`00989680 : 00000000`00000000 ffffde8b`068bdc01 00000000`00010100 fffff807`2b5b2f5d : vsdatant+0x89918
ffffd30d`02504a80 00000000`00000000 : ffffde8b`068bdc01 00000000`00010100 fffff807`2b5b2f5d 00000000`00989680 : 0x989680


SYMBOL_NAME:  vsdatant+10f19

MODULE_NAME: vsdatant

IMAGE_NAME:  vsdatant.sys

STACK_COMMAND:  .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET:  10f19

FAILURE_BUCKET_ID:  0x1E_c0000005_STACKPTR_ERROR_vsdatant!unknown_function

OS_VERSION:  10.0.18362.1

BUILDLAB_STR:  19h1_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {29dfa90a-0804-1c92-0b00-eaed1d0d7198}

Followup:     MachineOwner

 

Has anyone else reported an issue and/or incompatibility of this nature? 

--------------------------------------
GCentral

Christopher Stryker    2020 Americas CLA Summit Co-Chair






0 Kudos
Message 1 of 7
(259 Views)
Highlighted

Hey Chris,

 

Nice handle 🙂 I've not heard of this issue being reported. The TagService isn't really calling vsdatant.sys directly as much as it's using the network stack (which the VPN is embedded into). Searching into BSODs and vsdatant.sys seems to indicate a problem with ZoneAlarm. Does that software exist?

 

https://www.windowstechit.com/259/solved-windows-7-64-bit-bsod-errors-simple-solutions/

https://answers.microsoft.com/en-us/windows/forum/all/solved-help-blue-screen-error/6608efad-c9a5-46...

https://www.tenforums.com/bsod-crashes-debugging/91992-bsod-after-installing-checkpoint-vpn.html

 

When did this start occurring? 

Anything update recently or was it ever since TagService was installed?

 

Thanks,

Ryan F

0 Kudos
Message 2 of 7
(237 Views)
Highlighted

Sorry, I should have been more clear; I assumed it was a network stack issue and not a direct call.

 

It started occurring right after the Check Point VPN client was installed (which either shares some dependencies with Zone Alarm or uses it directly). I'm not necessarily pointing my finger at SystemLink as the guilty party, but something about the way it interfaces with the vsdatant driver seems to be causing it, even if that's just exposing a latent bug in said driver.

 

Worth noting, these happen relatively frequently (2-3/day) and it seems to be consistently the same basic cause... TagService crashing after a call to the vsdatant.sys driver.

 

The only things I currently have installed with "SystemLink" in the name are the LabVIEW SystemLink Toolkit and the NI SystemLink Client. Would uninstalling those two packages get rid of the TagService, or is it integrated more deeply?

 

--------------------------------------
GCentral

Christopher Stryker    2020 Americas CLA Summit Co-Chair






0 Kudos
Message 3 of 7
(221 Views)
Highlighted
Solution
Accepted by topic author ChrisStrykesAgain

The Tag Service doesn't install with the LabVIEW SystemLink Toolkit or the NI SystemLink Client.  Those are the client side components that typically connect remotely to an external SystemLink Server that would be hosting the Tag Service.

 

However, the NI Tag Service does install with FlexLogger and the NXG Web Module.  Both of them use it internally for storing data, so they would need to be uninstalled for it to be removed.  You can also open the NI Package Manager and use the gear icon in the upper right to show the infrastructure components and then search for Tag Service in the list of installed software.  If you try to uninstall it, NIPM will show you what depends on it and will need to be removed.

0 Kudos
Message 4 of 7
(201 Views)
Highlighted

FWIW, my IT department just downgraded me from the "Endpoint Security VPN" to the "Check Point Mobile" VPN, and vsdatant.sys no longer seems to be on my drive. Hopefully that clears things up, which makes my prior question about what uses the tag service no longer relevant.

 

 

--------------------------------------
GCentral

Christopher Stryker    2020 Americas CLA Summit Co-Chair






0 Kudos
Message 5 of 7
(199 Views)
Highlighted

@JoshuaP wrote:

The Tag Service doesn't install with the LabVIEW SystemLink Toolkit or the NI SystemLink Client.  Those are the client side components that typically connect remotely to an external SystemLink Server that would be hosting the Tag Service.

 

However, the NI Tag Service does install with FlexLogger and the NXG Web Module.  Both of them use it internally for storing data, so they would need to be uninstalled for it to be removed.  You can also open the NI Package Manager and use the gear icon in the upper right to show the infrastructure components and then search for Tag Service in the list of installed software.  If you try to uninstall it, NIPM will show you what depends on it and will need to be removed.


Oops, my bad. I saw it in the Skyline directory and searched for "Skyline" in NIPM, which only displayed things with "SystemLink" in the name. I removed the web module quite some time ago, but I'm guessing it's just a remnant. Regardless, fingers crossed that the downgrade fixed it.

--------------------------------------
GCentral

Christopher Stryker    2020 Americas CLA Summit Co-Chair






0 Kudos
Message 6 of 7
(197 Views)
Highlighted

Update for posterity: 24-hours without a BSOD, so removing the security suite seems to have resolved the issue. 

--------------------------------------
GCentral

Christopher Stryker    2020 Americas CLA Summit Co-Chair






Message 7 of 7
(157 Views)