000035825 - Kernel Drive Error 0xe001000f in RSA NetWitness Endpoint

Document created by RSA Customer Support Employee on Dec 14, 2017Last modified by RSA Customer Support Employee on Oct 17, 2018
Version 4Show Document
  • View in full screen mode

Article Content

Article Number000035825
Applies ToRSA Product Set: NetWitness Endpoint
RSA Product/Service Type: NetWitness Endpoint
RSA Version/Condition:,, 4.2.x,,,, 4,4.0.3, 
Platform: Windows
O/S Version: Windows
IssueOccasionally a driver error code of 0xe001000f is reported by the kernel driver of the endpoint agent and recorded in the database for the agent. This results in a disabled kernel driver and reduced endpoint visibility.
CauseThis is caused by a variety of factors. The specific issue addressed in this article is the UMA to KMA agent heartbeat error. This occurs due to synchronization being lost following a timeout error. Per RSA Engineering:

Added Synchronization in the driver to make sure timeout for connection doesn't happen while resuming from sleep

NOTE: This is referring to only ONE cause of the 0xe001000f error, as this is a catch-all error code; it can be caused by a variety of factors, and future instances of this error need to be investigated independently.

ResolutionUpgrade to for the specific fix to the heartbeat error

If running a version equal or newer than the above version( and still experiencing persistent 0xe001000f errors, contact RSA Customer Support to open a new case to investigate the root cause of the error generated.
WorkaroundThe workaround to this issue is to reboot the offending agent. When the agent is rebooted, the kernel state on the endpoint is cleared, and the agent reports back the KMA is online (status code 0x00000000), which will then show as online without error. This does not mean the error could not recur, but it does show, following a reboot, that the KMA started and is running normally.