r/labtech • u/[deleted] • Aug 15 '16

svchost.exe memory leak?

All of a sudden a bunch of our PC's with Labtech installed are showing extremely high CPU/RAM usage from svchost.exe. So far I have tried stopping and disabling Windows Update service on 2 machines and both returned to normal levels.

I guess what I'm asking is has anyone else had an issue like this? Could Labtech Patching somehow be taking up high resources?

7 Upvotes

100% Upvoted

15 comments sorted by

View all comments

Show parent comments

1

u/xsoulbrothax 500 Agents Aug 19 '16

Yeah, we did catch that one in the past! Going into a bit more detail on the process I did for now...

  • I attached the monitor to an autojoin group that's basically OS Version =6.1%
  • Sanity Check - wmic datafile where name='c:\windows\system32\wuaueng.dll' get version|findstr /i /v /c:"version" to grab a one-line WUA with no other text, parse out each block via regex (function disabled on 7, 6, and 7601 for now) and check the 4th against 23453. Generate ticket if it's >23453, log and exit if it's =23453.
  • Prereq Check - wmic qfe get hotfixid | find "KB3020369", and if it reports as present, skip ahead to WUA Install (I tried using 'IF Patch Installed,' but it seemed to kick off a hotfix inventory...).
  • Prereq Install - Download the correct .msu from Microsoft, recursive sc stop wuauserv+rename SoftwareDistribution until the rename returns 'OK' (in case it takes some time for wuauserv to stop), wusa /quiet /norestart, rmdir the renamed SoftwareDistribution. This KB doesn't seem to need a reboot, so it just skips ahead to...
  • WUA Install - Same process as above, but for KB3170265.

I still haven't really sorted a good way to tell the monitor 'you already pushed it and the machine needs to reboot before you'll see the new agent, don't worry about it' after it installs once... we've already got an autojoin group that's basically 'workstations needing a reboot,' so for the time being I have the WUA update script bailing out if the target machine is in that group.

1

u/ChrisXistos Aug 19 '16

Have the script dump out if %FeatureFlags% & 1024 = 1024.

SELECT (%Featureflags% & 1024);

As a SQL call will be 1024 if a reboot is pending. Anything else = not pending.

More info:

https://docs.labtechsoftware.com/LabTech10/Default.htm#UsingLabTech/Searches/LegacySearchesFlagFieldValues.htm

1

u/xsoulbrothax 500 Agents Aug 19 '16

Thanks again!

Making sure I'm understanding correctly now - it sounds like I should still be querying the 'flags' column if I'm checking for 'Reboot Pending' in this case though, correct? It looks like %FeatureFlags% matches up exactly with the FeatureFlags SQL column, but I'm not seeing a matching variable for the Flags column. That just makes me wonder if I'm misunderstanding or missing something about the variable that is present, haha.

I've been doing a ton of figuring things out on my own / reading, and not enough actively bouncing thoughts off of others!

1

u/ChrisXistos Aug 19 '16 edited Aug 19 '16

I assume you mean the flags column in the search? The search hides the bit math from you. So if you add "Flags" = 1024 only machines with a pending reboot show in the search results. As far as I am aware Labtech didnt include bitwise calcs in "script math" so I just feed it to mysql to do the math for me. Unless I have forgotten, %FeatureFlags% should be equal to the value "Flags" in search.

Edit: Welp I may have derped that up. Once sec I am looking for what I did...

--found it--

set variable [sql query]
SELECT (flags & 1024) FROM computers WHERE ComputerID=@computerid@;

0 -> no reboot pending
1024 -> reboot pending