andrewallen.co.uk / the musings of a technobabbler (who?)

Having recently been focused on a Citrix Presentation Server 4.5 migration, I took some time out to build a development 64-bit environment just to become familiar with any ‘gotchas’… This was a single, stand-alone Windows Server 2003 R2 Standard SP2 64-bit operating system, with the 64-bit Citrix Presentation Server 4.5 Enterprise Edition installed, running inside XenServer 4.1 RC7 XenServer 4.1 - I chose to install .NET Framework 3.5 (which includes the required .NET Framework 2.0) and JRE 1.5.0_09.

Additionally, I installed the following components onto the same box:

• Citrix License Server 11.3 (inc. Microsoft Visual J# 2.0 )
• Citrix Web Interface 4.6 (plus required Access Management Console Extension)

The following hotfixes were then applied to CPS:

• Citrix Hotfix Rollup Pack PSE450W2K3X64R01.msp
• Citrix Hotfix PSE450R01W2K3X64003.msp
• Citrix Hotfix PSE450R01W2K3X64004.msp
• Citrix Hotfix PSE450R01W2K3X64005.msp
• Citrix Hotfix PSE450R01W2K3X64012.msp
• Citrix Hotfix PSE450R01W2K3X64014.msp
• Citrix Hotfix PSE450R01W2K3X64016.msp
• Citrix Hotfix PSE450R01W2K3X64019.msp
• Citrix Hotfix PSE450R01W2K3X64020.msp
• Citrix Hotfix PSE450R01W2K3X64023.msp

As a side note, I had installation errors on the rollup, and hotfix 005, but all seems to be working ok… anyway, at some point post-installation the Web Interface decided to stop working. The following error was recorded in the application event log:

Event Type: Error
Event Source: .NET Runtime
Event Category: None
Event ID: 1023
Date: 13/03/2008
Time: 13:05:20
User: N/A
Computer: VM4
Description:
.NET Runtime version 2.0.50727.1433 - Fatal Execution Engine Error (79FFEE24) (80131506)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Server reboots / iisresets had no effect, and after lots of Googling, it looked like there might be a specific .NET hotfix to address the issue (KB913384), however it was only applicable to an older version of the .NET Framework 2.0 - it is supposed to be included / resolved in SP1 (build 1433). Another google confirmed this. After much frustration from a lack of solutions on the Citrix forums / knowledge base, I ended up uninstalling .NET Framework completely (you have to uninstall 3.5, then 3.0 SP1, then 2.0 SP1 in that specific order), then reinstalling the .NET Framework 2.0 RTM (build 42).

Once I then re-installed Web Interface 4.6 (enabling 32-bit mode in the process, as prompted) and then deleted and re-added the existing site within the Access Management Console, it all sprang back into life. I’ve not yet re-patched .NET to see if it remains functional…

Update 1

The error has occured again:

Event Type: Error
Event Source: .NET Runtime
Event Category: None
Event ID: 1023
Date: 14/03/2008
Time: 08:18:27
User: N/A
Computer: VM4
Description:
.NET Runtime version 2.0.50727.42 - Fatal Execution Engine Error (7A05E2B3) (80131506)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

This time, the only change I’ve made is to install the latest Citrix XenCenter console 4.1 RC7, which itself is .NET application. I ended up having to install the KB913384 fix, which this time was appliable to the version of .NET I had installed. I am going to do a bit more testing to see what is causing it to re-fail.

Update 2

And again…

Event Type: Error
Event Source: .NET Runtime
Event Category: None
Event ID: 1023
Date: 17/03/2008
Time: 10:55:32
User: N/A
Computer: VM4
Description:
.NET Runtime version 2.0.50727.63 - Fatal Execution Engine Error (7A05F093) (80131506)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

This time I had installed and uninstalled Office 2007.

Please note, an audio version of this post is available for download here.

I’ve recently been trying to improve a SOX process for analysing firewall activity, currently based on a manual daily check. As part of that work, I knocked together a quick batch file which can be used for automating the export of logs from Check Point FireWall-1, since by default, the logs generated are not readable as standard ascii text. The logs need to be exported using ‘fwm.exe logexport’, which outputs into a more readable CSV format, allowing you to carry out pre-processing of the data using other tools, such as the excellent fwlogsum.

@ECHO OFF & SETLOCAL ENABLEEXTENSIONS

:: "fw1export.cmd" (version 1.0, 01/11/2007)
:: by Andrew G. Allen, http://www.andrewallen.co.uk/

:: This work is licenced under a Creative Commons License.
:: Visit http://creativecommons.org/licenses/by/2.0/uk/ for more information.
 
:VARIABLES
 
SET v_SCRIPTDIR=D:\SCRIPTS
SET v_WORKINGDIR=%v_SCRIPTDIR%\FW1EXPORT
SET v_INPUTDIR=D:\WINNT\FW1\R60\fw1\log
SET v_FWM=D:\WINNT\FW1\R60\fw1\bin\v_FWM.exe

:END_VARIABLES

:: *** NO EDITING REQUIRED PAST THIS POINT *************************************

::       1         2         3         4         5         6         7         8
:: 45678901234567890123456789012345678901234567890123456789012345678901234567890

:CODE

IF NOT EXIST %v_SCRIPTDIR% MD %v_SCRIPTDIR%
IF NOT EXIST %v_WORKINGDIR% MD %v_WORKINGDIR%

DIR /B %v_INPUTDIR%\2007*.log | FIND /V "ptr" > %v_WORKINGDIR%\FW1EXPORT.TMP
FOR /F "TOKENS=1 DELIMS=" %%A IN (%v_WORKINGDIR%\FW1EXPORT.TMP) DO (
   IF NOT EXIST %v_WORKINGDIR%\%%A (
      %v_FWM% logexport -n -p -i %v_INPUTDIR%\%%A -o %v_WORKINGDIR%\%%A
   )
)
DEL /Q /F %v_WORKINGDIR%\FW1EXPORT.TMP

:END_CODE

You should setup the attached batch as a scheduled task to run once per day, once the logs have rotated.

Please note, an audio version of this post is available for download here.