Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Scanning has side effects on running java.exe? #282

Open
koppenho opened this issue Mar 3, 2022 · 1 comment
Open

Scanning has side effects on running java.exe? #282

koppenho opened this issue Mar 3, 2022 · 1 comment
Assignees
Labels
discussion question or suggestion

Comments

@koppenho
Copy link

koppenho commented Mar 3, 2022

Logpresso 2.9.2 scanning seems to have side effects on running java processes.
A customer receives warning messages in windows log from RestartManager for each Logpresso scan saying that (see also attached screenshot)
Application 'C:\Program Files\Java\jdk1.6.0_45\bin\java.exe' (pid ####) cannot be restarted - Application SID does not match Conductor SID..
These warnings are irritating because Logpresso is expected to do no modifications at all while in scanning mode.
Are they caused by Logpresso? If yes, how can we get rid of these warnings?
RestartManager

Logpresso has been started with:
C:\Windows\TEMP\log4j2-scan.exe --all-drives --exclude %SYSTEMROOT% --report-csv --report-path "C:\ProgramData\MyCustomer\logpresso\backup\log4jscan_2022-02-24T04.27.06.3618440+08.00_Scan.csv" --scan-log4j1

From the report we can read

Log4J_Status:'POTENTIALLY_VULNERABLE'
Log4J_Fixed:'n.a.'
file locked from x Process:'1'
File locked from ProcessName:'java', ProcessPath:'C:\Program Files\Java\jdk1.6.0_45\bin\java.exe'
ProcessPath 'C:\Program Files\Java\jdk1.6.0_45\bin\java.exe' x count available:'1'
Java_formatMsgNoLookups_Arr:'n.a.'
Java_Instance_Arr:'"C:\Program Files\Java\jdk1.6.0_45\bin\java"   -Xrs  -Dpilot -Dpilot.template=NO_REPORT  -Xms1024m -'
Java_Process_Arr:'C:\Program Files\Java\jdk1.6.0_45\bin\java.exe'
Java_Product_Arr:'Java'
Java_Version_Arr:'1.6.0_45'
Log4J_Hash:'9F5F5799707881451A39C1B2DD22B4E43B97A80698DB7DAF1C9697F545E24387'

BTW: Thanks for providing Logpresso.

@xeraph xeraph self-assigned this Mar 3, 2022
@xeraph
Copy link
Contributor

xeraph commented Mar 3, 2022

@koppenho
That is weird. If you are using log4j2-scan.exe, it does not use java on system. (it is self-executable image). Moreover, log4j2-scan is based on JDK7 (it cannot run on JDK6). I googled about RestartManager logs and many articles says it's permission issue. I think that is just a coincidence.

@xeraph xeraph added the discussion question or suggestion label Mar 3, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
discussion question or suggestion
Projects
None yet
Development

No branches or pull requests

2 participants