Dr. Watson errors for fw.exe

[BarryStiefel]

Dr. Watson errors for fw.exe



A Dr. Watson can best be described as a program crash. It's sort of like a "core dump" on a Unix platform.

If you get these messages immediately on startup, it may be because your node-limited license has expired.

On a Unix box, the various process used by FireWall-1 will show up as different processes (fwd, fwm, in.ahttpd, etc). They are all symbolically linked into one binary, however, 'fw'. On an NT box, there is no concept as a "symbolic link," so all of those seperate processes will show up as fw.exe. Unfortunately, this makes it very difficult to figure out what process is actually causing the Dr. Watson message. Thankfully in VPN-1/FireWall-1 NG, Check Point has created seperate binaries so Windows users can track the processes.

In the vast majority of cases, the crashes are occuring in one of the various security servers (HTTP, FTP, SMTP). In this case, you need not do anything as they will be restarted on their own. However, depending on what is causing the problem, continual Dr. Watson messages may appear.

If one of the more important processes dies (fwm or fwd), then you will either lose the ability to connect with the Security Policy Editor or you will lose the ability to use anything that relies on fwd (authentication, encryption, logging). If you lose either of these processes, you should restart FireWall-1 (fwstop, then fwstart). Alternatively, you can reboot the system automatically, using the shutdown program from the NT Resource Kit and the Scheduler service (Thanks to Geoff Albin for the tip):

AT 00:01:00 /EVERY: C:ntreskitshutdown.exe /L /R /Y /T:01

In FireWall-1 4.1 and later, a new occurrence of the dreaded Dr. Watson messages shows up: netsod.exe. This is the Policy Server process used for Secure Client to download desktop policy. On systems that are not using this feature, it can be disabled by editing $FWDIR/conf/fwauthd.conf and removing the line:

19190 netsod wait 19190

and bouncing FireWall-1.

If you are using any SMTP resources, it may be due to a message getting "stuck" in the mail spool.

-- PhoneBoy - 11 Jan 2004

FAQForm FAQs.Class: TroubleshootingFAQs FAQs.OS: OsWindows FAQs.Version: