We have two windows domain controllers that have Kace agent ver. 10.1.43 installed on them. On both servers on a consistent every six hours, we are seeing the ampwatchdog.exe start up the netstat.exe process. Why would it be doing this?
I have tried to look for any script or scheduled job and have come up empty.
0 Comments
[ + ] Show comments
Answers (2)
Please log in to answer
Posted by:
Nico_K
3 years ago
Let me guess:
You set the check in interval to 6hr.
And short after the tasks are started the inventory is updated for the system in question.
Comments:
-
Device Inventory was set to every four hours. I just changed it to 12 hours to see if I see a change in interval. - KJessie 3 years ago
-
please check where you have the agent inventory (Settings | Provisioning | Communication settings) if any of the settings is set to 6hr
Also you can run a KAT directly after it occured and check the agent logs which agent tasks were running. If you are unsure you can check with support to analyze these logs. - Nico_K 3 years ago -
Still seeing these events on a 6 hour cycle. - KJessie 3 years ago
Posted by:
scottcopus
3 years ago
Sysinternals Process Monitor (or maybe Process Explorer) is great for this. When using Process Monitor, after you catch that the netstat.exe process is launched, you can open up its Process Tree (under Tools) to see a tree-view process history. Examining the command-lines of processes in question may also help.
