uberAgent service stops after a few seconds

uberAgent service stops after a few seconds

book

Article ID: CTX692744

calendar_today

Updated On:

Description

Windows' Services console shows that uberAgent service is not running.

When manually started, the service starts and stops after a few seconds. 

uberAgent log file located in C:\Windows\Temp (default location) shows the issue with network driver startup. 

Example:

2025-03-01 17:28:33.013 +0200,INFO ,DOMAIN,MACHINE$,24984,NetworkDriver,Starting driver...
2025-03-01 17:28:33.019 +0200,ERROR,DOMAIN,MACHINE$,24984,NetworkDriver,Could not start driver. StartService failed with: The system cannot find the file specified.
2025-03-01 17:28:33.020 +0200,DEBUG,DOMAIN,MACHINE$,24984,NetworkDriver,Start and install...
2025-03-01 17:28:33.022 +0200,ERROR,DOMAIN,MACHINE$,24984,NetworkDriver,Could not install and load driver. Finished with The system cannot find the file specified.
2025-03-01 17:28:33.022 +0200,ERROR,DOMAIN,MACHINE$,24984,NetworkDriver,Starting driver failed with: The system cannot find the file specified.
2025-03-01 17:28:33.023 +0200,INFO ,DOMAIN,MACHINE$,24984,ShutdownApp,Shutting down...

 

Registry value DrvFailureCount located in HKLM\SYSTEM\CurrentControlSet\Services\uberAgentNetMon is set to 3.

No data is uploaded to Splunk from the affected machine. 

Environment

Caution! Using Registry Editor incorrectly can cause serious problems that might require you to reinstall your operating system. Citrix cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk. Be sure to back up the registry before you edit it.

Resolution

To re-enable uberAgent’s drivers, remove the following registry values and restart the uberAgent service:

  • DrvFailureCount
  • DrvStartupFinished
  • DrvShutdownFinished
  • DrvLastStart

Depending on the driver that triggered Driver Safety Net, the above registry values are located in one of the following two registry paths:

  • Process driver: HKLM\SYSTEM\CurrentControlSet\Services\UberAgentDrv
  • Network driver: HKLM\SYSTEM\CurrentControlSet\Services\uberAgentNetMon

Problem Cause

uberAgent’s drivers come with Driver Safety Net, a unique feature that prevents bluescreen loops: in the unlikely event of a crash in one of uberAgent’s drivers, the driver disables itself.

Once Driver Safety Net triggers, uberAgent’s drivers remain disabled until re-enabled

Additional Information

https://docs.citrix.com/en-us/uberagent/7-3-1/troubleshooting/uberagent-driver-safety-net-feature

Powered by Wolken Software