Article Number
000001653
Applies To
RSA Product Set: NetWitness Endpoint
RSA Product/Service Type: NetWitness Endpoint
RSA Version/Condition: 4.4.0.6
Platform: Windows
Issue
Active scanning is causing certain endpoints to have an agent crash. This happens during registry discrepancy scans, where the registry in question may have some corrupt or unreadable entries.
Cause
The registry, both due to memory over-allocation and due to a memory heap issue that causes the agent to crash and be restarted, fails the scan.
Resolution
Upgrade to the version 4.4.1.0 or later for the fixes to the memory.
Workaround
It is possible to avoid crashing by running a manual scan without the registry discrepancies option selected.
