topic Re: Security event id 5159 problem on Windows 2008 in ProLiant Servers (ML,DL,SL)

Security event id 5159 problem on Windows 2008

Richard Hrubizna — Fri, 26 Sep 2008 11:04:20 GMT

Hi I have a following problem,
every 30 seconds on Windows 2008 SP1 x64 on our HP Proliant DL 385 G5 server with PSP 8.11 installed is event id 5159 (Audit Failure) with following informantions generated.

Event id 5159
The Windows Filtering Platform has bloked a bind to a local port.
Applicatoin Information:
Process ID: 2928
Application Name: \device\hardiskvolume1\windows\system32\cpqmgmt\cqmghost\cqmghost.exe

Network Infromation:
Source Address: 0.0.0.0
Source Port: 50724
Protocol : 17

Filter Information:
Filter Run-Time ID: 0
Layer Name: Resource Assigment
Layer Run-Time ID: 36

Windows Firewall is off. The event stops when we stop HP Foundation Agents service. Thanks.

Re: Security event id 5159 problem on Windows 2008

KarloChacon — Sat, 27 Sep 2008 04:56:33 GMT

hi

try a previous version for Insight agents
- go to add and remove programs and remove HP insight management agents and install this previous version

http://h20000.www2.hp.com/bizsupport/TechSupport/SoftwareDescription.jsp?lang=en&cc=us&prodTypeId=15351&prodSeriesId=3646113&prodNameId=3646114&swEnvOID=4024&swLang=8&taskId=135&swItem=MTX-495c0e1cdbe940cb922c7bd625&mode=3

bye

Re: Security event id 5159 problem on Windows 2008

stevenice — Wed, 08 Oct 2008 18:42:28 GMT

I tried rolling back to the 8.10 Management agents but am still having the problem on two different servers. It logs an audit failure event in the windows security log every 10 seconds. The windows firewall is also turned off on my systems.

Any help would be appreciated..

Re: Security event id 5159 problem on Windows 2008

Richard Hrubizna — Thu, 09 Oct 2008 07:22:37 GMT

Rolling back to the 8.10 Management agents didn't solved the problem for me either. Stevenice , do you also have 64-bit system ? Because on 32-bit system I do not have such a problem.

Re: Security event id 5159 problem on Windows 2008

stevenice — Thu, 09 Oct 2008 12:20:10 GMT

I am having the problem on two different servers, one is 32 bit and one is 64 bit.

Re: Security event id 5159 problem on Windows 2008

jonwayne — Thu, 18 Dec 2008 01:52:20 GMT

Folks,

Has anyone gotten any feed back from HP Support on this reported issue, and what is HP's plans for providing a patch for this known issue with HP Insight Foundation Agent running on Windows Server 2008?

Thanks much!