Gatekeeper Hangs

[alyork]

Tried a search of the forums on this one but Gatekeeper is an excluded word.

Have had a number of times where Gatekeeper seems to have gotten stuck and doesn't update the activity screen. Stopping and re-starting Gatekeeper seems to get it going again.

Does anyone have any idea on how to fix this behavior?

Thanks - Al

(Running on Windows 2000 Advanced Server SP4.)

[rboynton]

Hi Al,

Are you watching this on the proxy box itself, or via a remote gatekeeper session? I had a problem early in my installation where the GK would hang if I left it on for an extended period, or if lots of activity was occurring. I even had times when the app would "go away" entirely! I had to stop/start the service to get things working again.

The only way I was able to work around this was to not look at Gatekeeper on the proxy box itself, but use a remote session. I have not had it recur since doing that.

[alyork]

Yes, we are running Gatekeeper on the proxy box. Haven't looked at running it remotely. How does that work?

[rboynton]

Simply have a copy of the gatekeeper.exe on any LAN machine and execute it. At the login, enter the IP of the proxy box and the login credentials as needed. I save the info so it is not required to log in next time. I don't make changes to Puresight or Kaspersky using this (I go directly to the proxy box for that) since it is not installed on my system. This remote session works fine for all other changes or monitoring tasks you might have.

[alyork]

Ah.

So that may not work where we monitor several client LAN's from a remote internet location?

Is our only choice then to run Gatekeeper on the Wingate machine which we can access the desktop via the internet?

Or ask qbik to fix the Gatekeeper hang problem?

Thanks - Al

[Nev]

Ah.

So that may not work where we monitor several client LAN's from a remote internet location?

Is our only choice then to run Gatekeeper on the Wingate machine which we can access the desktop via the internet?

Or ask qbik to fix the Gatekeeper hang problem?

Thanks - Al

Hi all,

The makers of Wingate did say that if you leave GateKeeper open for long periods of monitoring it can drain resources.

Do you leave GateKeeper running for long periods?

[logan]

I think Nev's hit the nail on the head. There is ALOT of data that has to be passed between the GateKeeper and the WinGate Engine when the GateKeeper is logged in. This constant drain is known to cause stability problems over extended periods of time which is why we recommend that the GateKeeper be logged out whenever it is not in use.

[alyork]

So why not just fix the Gatekeeper software then to make it stable?

[rboynton]

The stability of the new version is no doubt much improved over version 6.x... though version 6.x has worked very well for us. Much development time has gone into the new product while addressing many issues that have cropped up in version 6.x, so we're all looking forward to getting our paws onto it. I would not expect the developers to devote additional time and resources to modify the current version. The Gatekeeper resource drain is a known issue and can be worked around... for now.

[adrien]

There are 3 main areas where GateKeeper consumes memory

1. History panel.
2. System messages
3. Firewall panel

The longer you are connected, the more messages and items are displayed, and the more memory is used.

We never designed GateKeeper to be connected 24/7, so there's no code to purge this memory. And there's no reasonable basis upon which to purge this data either, if we started arbitrarily deleting items and records I'm sure that would result in other complaints about data going missing.

[alyork]

The big problem with users is that they never understand or care what the design criteria of a piece of software is.

As a result they turn on Gatekeeper and leave it runing until something hangs or crashes.

I think it would make more sense to anticipate the user than expecting them to work to your design.

As a suggestion, you could put a timer into Gatekeeper that would close it after so many minutes after initialization with a message informing the user as to what is happening. After all there are logs and files capturing the data so nothing should ever be lost.

[labull]

Al, you've been reading the threads. You know they're working on a major upgrade to the product and doing things like adding a timer to GateKeeper would only delay that.

You also know that anticipating everything a user does or every implementation they can think of is just about impossible. Sometimes the user just has to take the designers word for it when they say "don't do that".

Adrien has been open and honest about the limitations of GateKeeper. No need to take him task for it.

Those folks at Qbik are pretty smart and customer focused. They ain't perfect but they sure try to publish a quality product and they listen to the user community. They don't always agree but you'll be surprised how agreeable they can be.

[alyork]

I'm not intending to bash anyone.

However I've had numerous Gatekeeper hangs, and 2 server crashes attributable to Gatekeeper eating memory.

That in my mind is not a minor problem that will go away by an explanation. It needs to be fixed.

I've gone around and turned off the starting of Gatekeeper automatically on all our client sites and told people not to leave it running. I've also cut the history file sizes down from 50 meg to 5 meg.

However, I know the people aren't going to turn it off when not in use.

[labull]

Let's get some information then.

1. Why the need for the history files? Is there something that the log files for the various services doesn't give you?

2. Why do the users feel the need to run GateKeeper?

Just trying to figure out how things work.

[alyork]

Fair questions.

We've used the history to determine problem activities like we had one client with a rouge machine thet was sending out spam Rolex watch emails. Its been useful for other problem determination as well as it saves going to multiple log files and correlating the information.

History is set on by default. Would it make any difference to Gatekeeper if we turned it off unless needed?

The second question is everything to do with the user wanting to know what is happening. They are alway checking the activity to see what is going on and if the internet is working. Its called reassurance and has no logical basis at all. The other point is that they are migratees from Winproxy. Winproxy provides full time dynamic activity monitoring as well as hit counts for virus blocking, spam identification, blocked sites, incoming and out going spyware blocks, by http, pop3, ftp etc. They are used to seeing this stuff and expect to continue to see it.

In their mind, no or stuck Gatekeeper means the internet is not working and they call us to find out what's wrong.

So maybe the answer is some kind of mini-monitor that can run full time, keeping the user happy and reporting activity, hit counts and major problems only.

- Al

[defeX!]

There should be no need for the guys at qbik to write a new timer for the GateKeeper because one already exists. If you enable the session time-out in the Remote Control Service, idle gatekeeper's will be disconnected after the specified amount of time. Then admins can walk away from active GK sessions and they will close automatically.

GateKeeper
- System
-- Remote Control Service
--- Sessions

[alyork]

Ok its worth a try.

That will close GK down on the server?

[jamescap]

That will close GK down on the server?

No, it will timeout the session and disconnect.

The Remote Control Service in WinGate allows the GateKeeper to connect and configure the WinGate engine. By default I believe, there is no timeout. It will not close the GK application; it just disconnects the session, and the Administrator will need to click "Connect" to start it again. I would have to presume that this will purge the memory used by the GK but am not 100% sure; and I don't have WG 6 installed to test.


And here are some other tips:

1. It needs to be noted that the Remote Control Service timeout will affect the timeout of few authentication methods if they are in use: Java client, Qbik Auth Client, GateKeeper Authentication. Although Qbik Auth has an auto reconnect option in it - And even if a Java or GK authentication sessions timesout, other sessions that are passing through WinGate will keep the user authenticated until 30 second after no more sessions are active.

2. By default in WinGate, the Remote Control Service --> Bindings will be set to the "Internal" adapter as well as the localhost address.

3. If a WinGate installation has no password set for the Administrator account, then it will remove the binding for the "Internal" adapter. This is an internal security measure.

4. If you want to remotely connect to a WinGate engine, then that is a feature of the Professional, Enterprise and Trial (Enterprise) license types.
http://www.qbik.com/products/wingate/licensing.php

5. The Remote Control Service listens on TCP Port 808. So if you need to connect to that port remotely, then you need to have it bound to the interface that the connection comes in on.

6. To get the GateKeeper to another machine you can:
a) Copy it from C:\Program Files\Wingate\GateKeeper.exe
b) Download it from http://x.x.x.x:8010 – Where x.x.x.x is the ip address that the “Log File Service” is bound too.
c) Map a drive to the remote WinGate engine, and run the GateKeeper.exe from there - if over the internet this should be done by a VPN, or some other SSL type application.
*a) and b) I believe will not show the history, plugin configurations if I recall correctly.
c) will allow you to see the History and I believe plugin configurations etc... because where you are executing the GateKeeper has direct access to the history file etc...

Hope that helps.

[alyork]

Thanks.

I guess the issue here is that no one is running the GK Remote Control Service at any of my clients. They are running it only on the server and are looking at it either by logging onto the server console locally or from the internet.

Its my understanding that GK Remote Control can only be run from the internal LAN?

So what does timeout the session mean when GK is running on the server?

Thanks - Al

[ChrisH]

Its my understanding that GK Remote Control can only be run from the internal LAN?

No not just LAN -but depends on license- you can remote control from anywhere (more or less :)) Which is extremely useful at times! You need Professional or higher license. See here

[jamescap]

So what does timeout the session mean when GK is running on the server?

The Timeout value is specific to the Remote Control Service; it makes no difference whether the GK is connecting to this Remote Control Service from the local machines desktop where WinGate is installed, or from a desktop that does not have the WinGate engine installed.

For example, if you set the Remote Control Service --> Session --> Session Timeout to lets say 60 seconds for the sake of testing. And then you connect the GateKeeper to the WinGate engine and make no configuration changes; i.e. you are just monitoring activity, then after 60 seconds the timeout will occur, the WinGate engine will disconnect the GateKeeper session, and the GateKeeper will turn a gray colour. To monitor the activity again the Administrator would click the "Connect" button in the GateKeeper interface.

Definition:
WinGate Engine - The core of WinGate that provides Internet Connection Sharing.
GateKeeper.exe - The tool to be able to configure and monitor the WinGate engine - The GK does not need to be open, or connected to allow the WinGate engine to process internet requests.
Remote Control Service - The service that facilitates the GateKeeper to connect to the WinGate engine.

Tip:
If you change the Session timeout of the Remote Control Service, then that new timeout value will be used once your last connection has timed out (30 secs after you have no activity through any part of WinGate); if you are in a test environment, then just restart the WinGate engine so to clear any old sessions that are still running for your user, and hence the 60 second example will invoke with a new connection.

[alyork]

Thanks for everyone's comments and info.

In conclusion then, the bottom line is quite simply, if Gatekeeper is run on the server full time it will eventually self destruct and may take the server down with it.

And there is nothing I can do about it if the user wants to run Gatekeeper that way.

- Al

[adrien]

Hi Al

You make some fair points - I'll see what we can do about it for WinGate 2008.