icegridnode as windows service

[Edward Bishop]

I am trying to set up a collocated icegridnode as a windows service. It runs fine when I start it from the command line, but when I start it as a service I get:

C:\>sc start foolcol
[SC] StartService FAILED 1053:

The service did not respond to the start or control request in a timely fashion.

The interesting thing is, the icegridnode service does start - I can query the registry and the servers are activated on demand - and it runs for 30 seconds before windows shuts it down with the above error message.

The error occurs whether I configure the service to run as LocalService or as administrator.

I have followed the steps in the Manual for ensuring that the Data directories are Readable/Writable by all users. The system PATH variable includes C:\Ice-3.3.0-VC90\bin.

Here is the service info:

C:\>sc qc foolcol
[SC] GetServiceConfig SUCCESS

SERVICE_NAME: foolcol
        TYPE               : 110  WIN32_OWN_PROCESS (interactive)
        START_TYPE         : 3   DEMAND_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : icegridnode.exe  --Ice.Config=/foogrid/collocate.cfg
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : foolcol
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

and here is the config file:

#collocate.cfg

IceGrid.InstanceName=FooIceGrid

#
# The IceGrid locator proxy.
#
Ice.Default.Locator=FooIceGrid/Locator:tcp -h localhost -p 4061

#
# IceGrid node configuration.
#

#
# The node object adapter listens on all interface using an OS-
# assigned port
#
IceGrid.Node.Endpoints=tcp
IceGrid.Node.Name=node
IceGrid.Node.Data=\foogrid\node
IceGrid.Node.CollocateRegistry=1

#
# IceGrid registry configuration.
#

IceGrid.Registry.Client.Endpoints=tcp -h localhost -p 4061
IceGrid.Registry.Server.Endpoints=tcp
IceGrid.Registry.Internal.Endpoints=tcp
IceGrid.Registry.Data=\foogrid\registry
IceGrid.Registry.DefaultTemplates=\foogrid\foo.xml
IceGrid.Registry.PermissionsVerifier=FooIceGrid/NullPermissionsVerifier
IceGrid.Registry.AdminPermissionsVerifier=FooIceGrid/NullPermissionsVerifier

One more bit of info: My PC is running anti-virus software that is not entirely under my control due to corporate policy. However, I am able to add exceptions for icegridnode.exe, and/or port 4061, and to temporarily disable it and it doesn't seem to make any difference.

Any suggestions would be appreciated.

[bernard]

Hi Edward,

Did you try to install this service using the iceserviceinstall tool?

It does not look like you used iceserviceinstall: with iceserviceinstall, the service name would be icegridnode.<IceGrid instance name>.<Node name>.

Best regards,
Bernard

[Edward Bishop]

Hi Bernard,

I tried using the iceserviceinstall. I was unable to install the service as user LocalService. It would always come back with this error:

C:\>\Ice-3.3.0-VC90\bin\iceserviceinstall.exe icegridnode C:\Ice-3.3.0-VC90\config\icegridnode.cfg
Error: Could not retrieve effective rights for NT Authority\LocalService on C:\Documents and Settings\LocalService\Local Settings\Application Data\Ze
roC\icegrid\node1: Circular service dependency was specified.
Press any key to continue . . .

I did some googling about "Circular dependency", but didn't find anything solution. I also tried various directories and permissions (using cacls as described in the section H.4 "Manual Installation" and also through Windows Explorer) for IceGrid.Node.Data with the same results.

I found that I could install the service (although not successfully) with "sc", so that is what I have been using.

Thanks,

[bernard]

Hi Edward,

This is a surprising error! Did you setup previously any dependency between services?

Could you remove all your installed Ice/Windows services, and the ZeroC directory in C:\Documents and Settings\LocalService\Local Settings\Application Data, reboot (as Windows does not always cleanup removed Windows service until a reboot) and then try again?

Best regards,
Bernard

[bernard]

Hi Edward,

Could you also try to install a plain icegridregistry and icegridnode Windows service using the sample Windows service config file in your "config" directory?

Thanks,
Bernard

[bernard]

You can also get additional output from iceserviceinstall by passing the (undocumented) --Debug option.

Best regards,
Bernard

[Edward Bishop]

I removed all my attempted windows services, rebooted, tried iceserviceinstall with supplied config files, and got the same result:

C:\sunflower\AutoTest\bin>iceserviceinstall.exe icegridnode C:\Ice-3.3.0-VC90\config\icegridnode.cfg
Error: Could not retrieve effective rights for NT Authority\LocalService on C:\Documents and Settings\LocalService\Local Settings\Application Data\ZeroC\icegrid\node1: Circular ser
vice dependency was specified.
Press any key to continue . . .

C:\sunflower\AutoTest\bin>iceserviceinstall.exe icegridregistry C:\Ice-3.3.0-VC90\config\icegridregistry.cfg
Error: Could not retrieve effective rights for NT Authority\LocalService on C:\Documents and Settings\LocalService\Local Settings\Application Data\ZeroC\icegrid\registry: Circular
service dependency was specified.
Press any key to continue . . .

It doesn't like the "--Debug" flag, where in the command line would that go?

[Edward Bishop]

OK, "--Debug=1" works, but doesn't give much more info:

C:\sunflower\AutoTest\bin>iceserviceinstall.exe --Debug=1 icegridregistry C:\Ice-3.3.0-VC90\config\icegridregistry.cfg
[ 10/20/08 15:30:15.221 iceserviceinstall.exe: IceServiceInstaller: SID: S-1-5-19; Full name: NT Authority\LocalService ]
Error: Could not retrieve effective rights for NT Authority\LocalService on C:\Documents and Settings\LocalService\Local Settings\Application Data\ZeroC\icegrid\registry: Circular
service dependency was specified.
Press any key to continue . . .

[bernard]

Hi Edward,

If you look at the iceserviceinstall source code (which is quite straightforward) this error message comes from:

        TRUSTEE trustee;
        BuildTrusteeWithSid(&trustee, _sid);

        ACCESS_MASK accessMask = 0;
        res = GetEffectiveRightsFromAcl(acl, &trustee, &accessMask);

        if(res != ERROR_SUCCESS)
        {
            throw "Could not retrieve effective rights for " + _sidName + " on " + path + ": " + IceUtilInternal::errorToString(res);
        }

I don't understand how GetEffectiveRightsFromAcl can fail with this error.

iceserviceinstall adds dependencies to "netprofm", "Nla" (if they exist), which should be totally safe.

Did you try to install the service using another user, e.g. yourself? (the option is --ObjectName=<yourname> --Password=<yourpassword>).

Also, make sure to run iceserviceinstall as an administrator on your system.

Best regards,
Bernard

[Edward Bishop]

Hi Bernard,

Yes, that works. I can install and run the sample Windows services, icegridregistry and icegridnode, when I set "--ObjectName=myself".

In case I missed something, here is the cacls output:

C:\Documents and Settings\LocalService\Local Settings\Application Data>cacls ZeroC
C:\Documents and Settings\LocalService\Local Settings\Application Data\ZeroC NT AUTHORITY\LOCAL SERVICE:F
                                                                             NT AUTHORITY\LOCAL SERVICE:(OI)(CI)(IO)F
                                                                             NT AUTHORITY\SYSTEM:F
                                                                             NT AUTHORITY\SYSTEM:(OI)(CI)(IO)F
                                                                             BUILTIN\Administrators:F
                                                                             BUILTIN\Administrators:(OI)(CI)(IO)F

I really appreciate your help on this. I know that it will eventually turn out some obscure account setting, or service, or anti-virus, or environment variable, or something causing the problem. But I would like to solve as many potential problems now, before I start installing the software on a variety of PCs around the office.

Thanks,

[bernard]

Hi Edward,

Which Windows version do you use on this PC? (The location of the LocalService home directory varies from version to version).

Can you reproduce this problem on another Windows PC?

Thanks,
Bernard

[Edward Bishop]

Hi Bernard,

It's running Windows XP Pro service pack 2.

I'll try reproducing the problem on another PC. Every PC around here is slightly different because every developer has his or her favorite tools, etc. However, the overall corporate account management, anti-virus, etc., should be the same.

Thanks,

[Edward Bishop]

Hi Bernard,

I get the same error on another PC:

C:\>\Ice-3.3.0-VC90\bin\iceserviceinstall.exe --Debug=1 icegridregistry C:\Ice-3.3.0-VC90\config\icegridregistry.cfg
[ 10/21/08 11:19:40.883 /Ice-3.3.0-VC90/bin/iceserviceinstall.exe: IceServiceInstaller: SID: S-1-5-19; Full name: NT Authority\LocalService ]
Error: Could not retrieve effective rights for NT Authority\LocalService on C:\Documents and Settings\LocalService\Local Settings\Application Data\ZeroC: Circular service dependency was specified.
Press any key to continue . . .

Thanks again,

[bernard]

Hi Edward,

Here is the expected output (also on XP SP2):

C:\>\Ice-3.3.0-VC90\bin\iceserviceinstall.exe --Debug=1 icegridregistry C:\Ice-3.3.0-VC90\config\icegridregistry.cfg
[ 10/21/08 14:46:18.172 /Ice-3.3.0-VC90/bin/iceserviceinstall.exe: IceServiceInstaller: SID: S-1-5-19; Full name: NT Authority\LocalService ]
[ 10/21/08 14:46:18.344 /Ice-3.3.0-VC90/bin/iceserviceinstall.exe: IceServiceInstaller: NT Authority\LocalService had already the desired permissions on C:\Documents and Settings\LocalService\Local Settings\Application Data\ZeroC ]
[ 10/21/08 14:46:18.391 /Ice-3.3.0-VC90/bin/iceserviceinstall.exe: IceServiceInstaller: NT Authority\LocalService had already the desired permissions on C:\Documents and Settings\LocalService\Local Settings\Application Data\ZeroC\icegrid ]
[ 10/21/08 14:46:18.422 /Ice-3.3.0-VC90/bin/iceserviceinstall.exe: IceServiceInstaller: NT Authority\LocalService had already the desired permissions on C:\Documents and Settings\LocalService\Local Settings\Application Data\ZeroC\icegrid\registry ]
[ 10/21/08 14:46:18.469 /Ice-3.3.0-VC90/bin/iceserviceinstall.exe: IceServiceInstaller: Granted access on C:\Ice-3.3.0-VC90\config\icegridregistry.cfg to NT Authority\LocalService ]
Press any key to continue . . .

Bernard

[Edward Bishop]

That is essentially what I get when I add the "--ObjectName=myself" option:

C:\>\Ice-3.3.0-VC90\bin\iceserviceinstall.exe --Debug=1 icegridregistry C:\Ice-3.3.0-VC90\config\icegridregistry.cfg --ObjectName=bishope
[ 10/21/08 11:55:08.004 /Ice-3.3.0-VC90/bin/iceserviceinstall.exe: IceServiceInstaller: SID: S-1-5-21-391068476-594298578-1233803906-69298; Full name: AM\bishope ]
[ 10/21/08 11:55:08.004 /Ice-3.3.0-VC90/bin/iceserviceinstall.exe: IceServiceInstaller: AM\bishope had already the desired permissions on C:\Documents and Settings\LocalService\Local Settings\Application Data\ZeroC\ic
egrid\registry ]
[ 10/21/08 11:55:08.051 /Ice-3.3.0-VC90/bin/iceserviceinstall.exe: IceServiceInstaller: AM\bishope had already the desired permissions on C:\Ice-3.3.0-VC90\config\icegridregistry.cfg ]
Press any key to continue . . .