Service stops running – how to troubleshoot?

[bsammon]

So, every now and then, one of our computers (so far it’s the same one each time) has the NoMachine service stop, and the service needs to be restarted.  And, as dictated by Murphy’s law, this is usually discovered when there are relatively few people in the office.

Any advice–or any documents I should read–about how to start troubleshooting this?

I’ve learned that there’s logfiles in %PROGRAMDATA%/NoMachine/var/log , and I’ve looked at them a little, but I’m not sure what to look for, which logfile is the most useful, or what verbosity log-level I should be using, or even, whether these logfiles are just the wrong place to be starting in.

This is a computer running Windows 11 Home/Business.

 

[Britgirl]

Can you send them to us and we’ll take a look? 🙂 Send them to forum[at]nomachine[dot]com. Zip up the entire var folder from the Windows 11 machine, we can start from that.

Then we’ll give you some further instructions.

[bowlsys]

Having a similar problem, service starts then stops.

What is shown in application event log is:-

Application Error 1000 Faulting application name: nxserver.bin, version: 8.16.1.0, time stamp: 0x00000000 Faulting module name: OLEAUT32.dll, version: 10.0.26100.3624, time stamp: 0xf9de6395 Exception code: 0xc0000005 Fault offset: 0x000000000009eaf3 Faulting process id: 0x4B44 Faulting application start time: 0x1DBA0AC0E6634FF Faulting application path: C:\Program Files\NoMachine\bin\nxserver.bin Faulting module path: C:\WINDOWS\System32\OLEAUT32.dll Report Id: bdf7c7ac-a710-42b2-950d-cc1db345f434

This happens before I am able to connect to this server.

Running NoMachine free version on Windows 11 24H2. NoMachine version 8.16.1

[bsammon]

Email sent.

My sense of the exact timetable of events is a little fuzzy, unfortunately.

If/when this problem recurs, I hope to gather more detailed and precise information.

 

[bsammon]

The problem has reoccurred.

As I write this message, the computer is inaccessable via NoMachine.  It is on the network, and HTTP and SMB and ICMP traffic seems to be working fine.

I have made a snapshot of the logfiles while the computer is inaccessible.  The logging level is currently at “7 – Verbose” (and has been for a few days), so the log file is rather large, but the entire log directory tree zips up to a manageable 4MB.

The error message I receive from the client app is “A connection timeout has occurred while trying to connect to <machine> on port <port>” followed by some boilerplate troubleshooting advice.

 

[Britgirl]

bsammon, we have received your logs.

[Guro]

Hello

please provide the results from running the following commands in power shell opened as Administrator.

1.  net user nx

in result should be listed if the user is still in admin group.

2.   wmic useraccount get name,sid | Select-String nx

to have nx user sid so that we can compare with the logs.

3. secedit /export /areas USER_RIGHTS /cfg privileges.txt

to have all permissions of user nx. and send to us privileges.txt file please.

If the default folder of power shell does not allow to save the file, then change path to file to another folder like:

secedit /export /areas USER_RIGHTS /cfg C:\Temp\ privileges.txt

4. Get-WinEvent -FilterHashtable @{LogName = 'Application'} | Where-Object {$_.Message -like '*nx*'}

will parse Windows application events and NX items.

I also have an additional question, how much time passed before the last Windows restart and the NoMachine service issues?

Thanks

 

[Britgirl]

You can send everything to forum[at] like last time.

[bsammon]

secedit /export /areas USER_RIGHTS /cfg C:\Temp\ privileges.txt

I’m not familiar with this secedit command, but it looks suspiciously like there’s a mistaken space between “C:\Temp\” and “privileges.txt”.

I’ll be trying this soon, so I’ll try doing exactly what your message says first, and hopefully that’ll work.

 

[bsammon]

I also have an additional question, how much time passed before the last Windows restart and the NoMachine service issues?

Roughly, I’d say less than 3 weeks.

If you think more precise answer would be useful, I’ll need to figure out how to get that information.  Do you know offhand where such information is found?

 

[bsammon]

email has been sent.

The output of step 1 is in “netuser.out”

The output of step 2 is in “wmic.out”

The output of step 4 is in “Get-WinEvent.out”

My concern about the suspicious whitespace in step 3 turned out to be unnecessary/irrelevant, since the first version of the secedit command invocation worked.

[Guro]

Hello

We investigated provided log data and it seems that it is not a permission issue. For now we suspect that issue might be related to incorrect interpretation of user token, but standard logs cannot provide such information as for security reason disabled logging one. Please let us know if you are willing to install nomachine debug package on the server and collect verbose logs.

Thanks

[Author]

Posts