A fix is available
Closed as program error.
Severity: 2 Approver: BEH Compid: 5724K1000 Tivoli Universal Agent Abstract: UA on Windows: Script DataProvider may terminate O/S process Environment: This problem was reported for Universal Agent on Windows 2008 Problem Description: UA SCRIPT Data Provider has logic to check for a whether a launched script process has not completed within its alloted time, 60 sec by default or per RUNTIME setting in metafile. Before UA terminates the script process it iterates thru any child processes spawned by the Script process. Due to some unknown Microsoft defect in CreateToolHelp32Snapshot() API on very rare occasion the data returned indicates the O/S binary CSRSS.exe as being a child process of customer's Script processed, UA terminates this CSRRS.exe, as it does any child process, and then customer encounters BSOD. Detailed Recreation Procedure: Not recreateable; problem has occurred only in Windows 2008 at customer installation. Related Files and Output: This problem cannot be determined by trace log.
This problem can occur when a launched script process has not completed within its alloted time, 60 sec by default or per RUNTIME setting in metafile. If you can guarantee the script finishes within its alloted time, this problem will not occur.
On Windows, the Universal Agent script data provider may terminate an unrelated process. This is a rare and random condition of the Universal Agent script data provider that has only been seen on Windows 2008 to date. In this case, the user's script was running frequently throughout the day, and the process CSRSS.EXE had been terminated only once during the year.
For reasons unknown, Microsoft's process API CreateToolhelp32Snapshot may return an incorrect parent process ID on a very rare occasion. Various forums on the Web indicate it is highly improbable that Microsoft will address this flaw. It is this incorrect parent process ID that causes Universal Agent to mistakenly terminate an unrelated process such as CSRSS.EXE. In this user's case, the process was related to critical OS processing, and the effect of terminating CSRSS.EXE crashed the Windows OS. This issue has been mitigated by providing additional process checks before a process is terminated. The fix for this APAR is contained in the following maintenance packages: | fix pack | 6.2.2-TIV-ITM-FP0009 | fix pack | 6.2.3-TIV-ITM-FP0002
Reported component name
Reported component ID
Last modified date
APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:
Fixed component name
Fixed component ID
Applicable component levels