Terminated the probe because the max timeout was reached: 610 seconds

[brukasmj]

The warning as printed in the subject line is popping up in the Logfile section and related to Powershell / Wmi runner

Is this something related to shortage of resources on the mid server or is it just a setting which needs to be customized ?

thanks

John

[Henrik Jutterst]

Hi John!

Did you manage to solve this, because I have the same issue and can't really find what is wrong. What was your problem and how did you solve it and how did you see what the problem was?

Kind Regards

/Henrik

[bbaghel]

We were facing similar issues during our implementation and the Discovery logs - ECC queue were full of error messages : "Terminated the probe..."

If you check your MID server logs and grab the payload document you might find errors similar to this :

03/24/17 14:37:09 (448) Worker-Standard:PowershellProbe WARNING *** WARNING *** ProcessRunner terminated due to interrupt java.lang.InterruptedException

03/24/17 14:37:09 (620) Gobbling stdout: Powershell is executing... SEVERE *** ERROR *** IOException while gobbling stream

If you do see these errors, that indicates you might not have WMI access on the windows servers you are trying to access, atleast that was the issue we were facing.

Let me know if this helps.

Thanks,

Bharat

[Henrik Jutterst]

Hi Bharat!

Well, I get almost the identical rows you posted. Except the last five characters (
)

05/30/17 13:57:32 (354) Worker-Standard:PowershellProbe WARNING *** WARNING *** ProcessRunner terminated due to interrupt java.lang.InterruptedException

05/30/17 13:28:11 (215) Worker-Standard:MultiProbe WARNING *** WARNING *** ProcessRunner terminated due to interrupt java.lang.InterruptedException

05/30/17 13:28:11 (242) Gobbling stdout: Powershell is executing... SEVERE *** ERROR *** IOException while gobbling stream

I'm pretty sure that WMI permissions are set and not an issue, but I will take a look at it once again. Thanks for sharing your thoughts/input!

[bbaghel]

No problem, as far as i know Windows server admins do a GPO push to all the servers to provide local admin access to the windows servers for Discovery (i am not a server specialist) but in our case, that GPO was not pushed to all servers due to a separate configuration or policies on some windows servers. So even if the server admins thought we should have access to all the servers, we did not. So, it might be worth checking with them just to rule out this possibility. Good luck.

in addition you can do this as well set the mid.powershell_api.session_pool.max_size as well as the threads.max to 50 in the configuration parameters of your MID Server, save then restart the MID Server.