[sims] Error while reading message framing format at position # of stream

[Garacesh]

Having this issue on about 60% of our computers that run SIMS here, clients just refuse to take the Summer 2022 update.

 

The errors we've had so far ar:

• Error while reading message framing format at position # of stream (state: ReadingEnvelopeChunkSize)
  
• Error while reading message framing format at position # of stream (state: EnvelopeEnd)
  
• The socket transfer timed out after 00:01:00. You have exceeded the timeout set on your binding. The time allotted to this operation may have been a portion of a longer timeout.
  

 

The most common error by far is the ReadingEnvelopeChunkSize one.

 

I don't know if it's related, but somebody with more SQL knowledge than I might be able to join some threads together.

A couple of weeks ago we started having major issues with SIMS. It would bomb out for absolutely no reason, whenever the heck it felt like it. Errors were intermittent and non-reproducible.

I spoke with our SIMS support and they had a poke around, they couldn't find the actual problem. They advised I run the SIMS reindexing patch (22573) and the 'Update all table statistics with fullscan' patch (20647), and a routine in SIMS that produces a list of errors in the db, which it automatically fixed some of. They also recommended I install the SQL Server Service Packs, which had never been done. So I did.

 

Now we're having issues where SIMS won't deploy properly, and also FMS where as finance do.. er.. FMS-y things, I have no idea truth be told.. It will generate blank records that then kill all functionality until it's restarted. This happens every couple of.. processes? I'd like to say something a bit more concrete except our business manager is off on holiday now lol.

 

The timing seems rather coincidental to me, but I'm not convinced.

 

ESS said they'd seen this issue before but never actually figured out what it was. They said it was "environmental", but reimaging fixed the issue. We did a few test machines last night. One of them installed SIMS fine. One of them didn't. Same ReadingEnvelopeChunkSize error.

 

Really at a loss of what to do now. I know next to nothing about SQL.

The only thing I can think of is to run DBCC CHECKDB WITH PHYSICAL_ONLY but I want to check that with ESS first. Heck maybe we already did that as part of the reindexing patch?

 

Has anybody ever seen this before? Any ideas? Our staff here are pulling their hair out about it and obviously having only 30% of the staff machines able to use the MIS is a massive issue...

[psydii]

What AV do you have? Does it do network inspection? Try testing with it fully disabled, or with network inspection turned off. On both server and client.

 

Also try with a clean LTSB Windows 10 build and see if the problem is replicable there.

 

Final thing (and quite the long-shot) is everything configured to connect to sims via hostname, if not try updating things so that they do.

[Garacesh]

AV is Sophos, but there's no correlation between it working and not working regarding the AV. Every machine we even attempt to install SIMS on has Sophos on, as it's part of the task sequence.

Pretty sure everything in SIMS is done by hostname. I'll dig through, but I've only ever seen clients referenced by hostname - certainly that's how we do our deployments, though how Solus references things internally are beyond me.

.. I suppose except the sims share, that's mapped as a drive and referenced by drive letter. But that can't be it, as Solus still installs/deploys to computers when there's no user logged in, so it's not going to be using a drive letter.

 

The bit that's bugging me is how intermittent it is. Our machines are all identical. Same image, same GPO's, same software mostly (there's a few inconsistencies, ICT have extra software for example, but nothing that's producing any correlation).

If this were something to do with the way our domain was set up, why would 30% of the machines update successfully?

Then again, if the error were truly intermittent, it wouldn't keep failing as it does on the same machines repeatably. Although the position # of stream changes each time.

Edited July 15, 2022 by Garacesh

[psydii]

That's why I ask about AV - its the one thing that hooks deep into the network stack and updates regularly - so just because it was fine yesterday, it might not be today.

 

Also who knows what changes actually get rolled into monthly updates these days, so rolling a machine back to an older Windows build and testing that might also help eliminate variables.

 

I mean it is most likely some sort of bug in ESS's code... but it is very difficult to get them to investigate properly.

[Garacesh]

FFFFFFFFFFFFUUUUUUUUUU-

Y'know what. It is the Antivirus.

 

Somehow, for some dumb reason, Sophos has started stopping clients pulling data from across the network. Can't even do basic file transfers.

As soon as I disable tamper protection and uninstall it? Boom. Job done.

 

But this isn't just SIMS. I literally can't copy one folder from the C: of one host to the C: of an affected host. I get about four files in and transfer speed drops to nil.

This probably explains the MSOffice issues we've been having, too, where Office won't load content in files randomly.

[4l3x]

Did you manage to find a solution to this? I've been having the same issues started last week.

[ArunG69]

Hi,

 

I've got the same issue, everything working great, went to deploy Sims, that's when it fell apart.

[Anonymous2000]

Pretty sure this is related to Sophos.

[Garacesh]

Sorry guys, I've been moving house (and jobs)

Yes, the issue is absolutely an issue with Sophos, and the Network Threat Protection module.

 

I didn't have a solution before leaving beyond "enable the bit that lets you overwrite settings for 4 hours', disable NTP, and do whatever it is you had to do. It didn't seem there was a way to disable it using the available options in Sophos Central

[HarkNowHear]

Damn. We've just had the same issue pop up after a week of fighting Sophos - it's completely killed running applications over the network, print driver installation and now this. Infuriating!

[round2it]

i think it is a known issue (other posts regarding slow pdf loading on here) i think sophos have a patch

[Carrot63]

Hi

We are having the same sort of issues as well. Does anyone know what the patch id/description is if Sophos do have one?

 

Thanks

[Garacesh]

Hi

We are having the same sort of issues as well. Does anyone know what the patch id/description is if Sophos do have one?

 

Thanks

 

I'm afraid to say that despite my earlier assertion that it wasn't Sophos.. Yep, it was Sophos.

 

See this thread for more information