Dynatrace oneagent installation with Windows 2019

[sundarv1]

After we do upgrade of oneagent update in Windows 2019 Server , Remote desktop connection to server is lost.

Oneagent is getting upgraded successfully. But it require a reboot to resolve the Remote desktop connection  issue.

This issue happens only in Windows 2019. Windows 2016 all loooks good.

[jonhaugen · Accepted solution]

Hi, 

From my own experience, this seems to be only affecting a specific Windows 2019 build, and happens only when Npcap is installed or upgraded.

The problem occurs because the Npcap driver shipped with the Oneagent installation has a bug which seems to cut all incoming and outgoing connections to the server. The workaround is either to disable Npcap installation or reboot. 

You can try to reach out to Nmap (https://nmap.org/), and see if they have had any similar reports on your current build.

Best of luck!

[sundarv1]

Hi Jon - Have you raised ticket with Dynatrace why they are shipping Npcap driver shipped with the Oneagent installation has a bug?. 

[jonhaugen · Accepted solution]

The ticket with Dynatrace was eventually closed, however here is the feedback: 

"There is Windows 2019 server (1809) which known problem that installing npcap driver causes whole host network disruption. This problem was studied time ago by nmap company which releases npcap and the pointed out there is a bug inside windows kernel (especially 1809) then problem got redirected to Microsoft - now to my knowledge other versions of Windows are not affected. There is hotfix installed KB4571748but there may other factors that make problem is still present e.g. some WAN miport drivers are present"

[sundarv1]

Hi Jon

But npcap is installed as part of dynatrace oneagent installation not thru windows 2019 OS.

Npcap Oneagent is installed thru dynatrace oneagent installation

[jonhaugen · Accepted solution]

Indeed, to disable Npcap during Oneagent installation you will have to manually disable the feature from the Oneagent. Sometimes Dynatrace upgrades the Npcap version shipped with OA, which will trigger a Npcap installation and therefore the network disruption may happen to the 1809 servers. 

[sundarv1]

Hi Jon

Thanks. Please let us know how to disable the Npcap version shipped with OA?

Should we use pcap_driver=winpcap 

If we use pcap_driver = disable what is the impact of not having oneagent network monitoring module.

[jonhaugen]

I would not recommend to use winpcap as the support has been discontinued. 

The impact by not having the npcap driver installed is that you will be missing out on the topology and networking features in Dynatrace, which for example is used in the Smartscape Topology.

Here are some options based on your strategy, not disabling: 

• Set up a maintenance schedule to patch OA within certain hours, so you can reboot the 2019 servers accordingly. 
• Subscribe to the OA agent releases, so you know when a new npcap version is going to be installed. 

Disabling Npcap: 

• Install standalone Npcap. The OA upgrades will respect any previously installed Npcap versions. This will benefit you by manually installing Npcap, and automatically update OA.
• Disable Npcap and decide what impact it has for your environment. 

[Peter_Youssef]

Hello @sundarv1 

You can refer to Dynatrace documentation regarding pcap driver, if pcap part of the issue.

packet_capture_driver 

You can stop OA service and adjust this configuration.

BR,

Peter

[sundarv1]

Hi Peter

When we do oneagent upgrade via dynatrace console, where do we specify the npcap parameter?. Could you please share?,

[Peter_Youssef]

Hello @sundarv1 

It's not available through the installation UI, so you can do it through installation scripts or after deployment via oneagentctl.

.\oneagentctl.exe --set-PCAP_DRIVER=npcap

PFA attached URL : windows-custom-installation#packet_capture_driver for detailed info.

Tip:

• stop OA service then Run the attached command > Restart OA service to apply changes.
• stop-restart-oneagent-windows 
• oneagent-security-windows 

Do it and keep us posted 😉

[sundarv1]

Hi Peter

What we are seeing  npcap agent is installed for oneagent installation.  we did oneagent update via UI and npcap oneagent is installed part of this installation.

Thanks

Sundar.v

Thanks

Sundar.v

[Peter_Youssef]

Hi @sundarv1 
Exactly, it's included in the installation process, once you install or update the OA.

[sundarv1]

If oneagent is installing npcap then what we need to do resolve the Remote desktop connecivity issue or host connecvity issue after agent upgraded successfully. 

[sundarv1]

If oneagent is installing npcap then what we need to do resolve the Remote desktop connecivity issue or host connecvity issue after agent upgraded successfully. 

[sundarv1]

If oneagent is installing npcap then what we need to do resolve the Remote desktop connecivity issue or host connecvity issue after agent upgraded successfully.

[Peter_Youssef]

Hi @sundarv1 

for OA auto-update command during the installation specify the attached command beside the installation script.

[Peter_Youssef]

Hi @sundarv1 

There is another solution to avoid such scenario in future:

Go to the target server > settings > process group monitoring > add process group > select the process group from the drop down menu which will be "Remote Desktop Connection" by default and select do not monitor to avoid the OA code modules injection.

So whenever update is triggered this "Remote Desktop Connection" won't be impacted at all.

BR,

Peter

[Peter_Youssef]

Hi @sundarv1 

You have a good option if these Win server 2019 are grouped under host group.

Infrastructure observability > Process and technologies > filter by "Remote Desktop Connection" > then Edit and add monitoring rule > do not monitor so these servers won't be affected.

KR,

Peter.

[p_devulapalli]

Hi @sundarv1 , Please see below, seems related

https://community.dynatrace.com/t5/Troubleshooting/Network-monitoring-Potential-network-disruption-d...

[sundarv1]

Our oneagent versiion is 1.299 and Windows is 2019 and 1809. Wincap is not installed. only npcap is installed as part of oneagent installation.

[Peter_Youssef]

Hello @sundarv1 

Kindly find the attached URL to check the current configuration

• https://github.com/thalpius/Microsoft-Defender-for-Identity-NPCAP-Config-Checker/tree/main
• it contains detailed steps, check the steps and keep us posted.

[Peter_Youssef · Accepted solution]

Hello @sundarv1 

Have you tried uninstalling any existing Pcap driver 

PFA Dynatrace documentation to follow : 

• https://docs.dynatrace.com/docs/shortlink/oneagent-windows-install#winpcapuninstall

Troubleshooting URLs:

• https://docs.dynatrace.com/docs/platform-modules/infrastructure-monitoring/networks/troubleshoot-net...

BR,

Peter

[sundarv1]

There is no wincap and npcap driver previously. it was installed when we install oneagent only.