failed to create document

[bkirchoff]

I get a message when starting a trace...failed to create a document. I can run the trace and capture packets, view the packets in the detail window, but nothing shows up in the expert window, it's just blank.

Anyone know where I can get some info on the ART application response time?

 

[wybnormal]

Which version are you using? THis is pretty common with distributed sniffer. Have you tweaked the config at all?

MikeS Find me at

http://www.packetattack.com

"The trouble with giving up civil rights is that you never get them back"

 

[bkirchoff]

No I haven't touched any configs, I'm getting this on several of my distributed sniffers, which are running version 4.5. I think the problem maybe on the console desktop...I don't know? I should see if I get the same message on my desktop sniffer.

 

[bkirchoff]

I'm running distributed sniffer 4.5. I'm getting this message on various sniffers at different sites. I guess I should check and see if this same error occurs on my console sniffer.

 

[AlfSutherland]

Hi,
The message "Failed to create empty document" will appear when Distributed Communications(DCOM) is not established between the Agent and Console. The DSSRMON system uses DCOM to establish and maintain Expert. Failure to establish DCOM is usually exhibited by the appearance of the message "Failed to create empty document" after trying to start a trace capture with real-time expert enabled. There are a few causes of this problem;
1. Make sure the console software is the same as the agents. The newest version is v4.1 ph2 (v4.10.48) except for ATM. Agent and Console software are NOT back-ward compatable with each other.
2. Make sure you haven't got previous versions of old console software installed on your machine. Did you install new software on top of older version? If so remove both, I can tell you how safely.
3. Make sure the Bindings are set correctly on the agent, eg Sniffer only bound to NAI card(s).
4. Are you using a firewall between agent and console? If so you may have to open up some ports.
I can send you greater info on these if required, if you add your email address.
Yours, Alf

 

[wybnormal]

Hey Alf- could you send me some of the detailed info? I went looking for my tech-notes on my last upgrade and I cant find them :-(

Thanks

MikeS

webmaster@nospamhere.packetattack.com Find me at

http://www.packetattack.com

"The trouble with giving up civil rights is that you never get them back"

 

[bkirchoff]

Alf-
You can reach me at kirchor@labs.wyeth.com I have a lot of these upgrade problems.

 

[AZeemeri]

First check if you have MS I Explorer 5.0 and above with virtual machine installed. This can cause this error.

Second, it can be a conflict with the UDP port in use by both the REMOTE agent and DSPro agent software.
The fix for this is:
1. Open regedt32.exe
2. HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc ---> move "NCACN_IP_TCP" to the top of the list
3. Add three values under this key:

Name Type Value
Ports REG_MULTI_SZ 2002-2010
PortsInternetAvailable REG_SZ Y
UseInternetPorts REG_SZ Y

4. Using dcomcnfg.exe, modify the default authentication level to "none" found under the default properties tab.
5. Reboot your system.


Another fix could be:
On the startmenu of the DSpro server Go to Run. Open dcomcnfg. Under the "Default Authentication Level" and Select none.

And last but not least verify the following

1. The monitor card should not have TCP/IP bindings EXCEPT if using the Full Duplex Pod (see 3 below). Only the transport card should have TCP/IP bound to it. Disable the monitor card's TCP/IP binding using the Network utility in NT's Control Panel. Click on Bindings. Select to show bindings for all adapters. Expand the monitor adapter list. Disable TCP/IP and WINS (if listed) for the monitor adapter. Only Sniffer Driver should be bound. Click OK and reboot NT.

2. If NetBEUI was added as a protocol to the Agent make sure that it is not bound to both the transport and monitor cards. Unbind it from the monitor card. If NetBEUI is a protocol configured for the console which has multiple network interface cards, make sure it is only bound to one card.

3. When using a Full Duplex Pod: You will need to keep TCP/IP and the Sniffer Driver bound to the monitor card. In this case, make sure that IP forwarding is turned off, and that no other protocols are bound to the monitor card such as NetBEUI and WINS. Ensure that an ip gateway is not specified on the monitor card.

4. Do not run DSPro Console on the same machine as Sniffer Pro. If you are, uninstall both, then reinstall the DSPro Console.

5. Launching multiple Consoles and running capture on each instantaneously may cause the capture session to fail. "Failed to create empty document" will appear on the screen. Allow the first capture session to start completely before starting the second.

6. Ensure that DSPro versions are the same on BOTH the Console and Agent.

7. On Win 95 or Win 98 DSPro Consoles, make sure it is set to a Domain, and not a Workgroup. This setting is under Control Panel/Networks.

8. Conflict with DataComm ConnectIT software on the agent. REMOTEagent.exe is running as a service process on the DSPro agent. Interoperability with ConnectIT software has not been fully tested or supported. Please check back here periodically for an update to this issue.

 

[bkirchoff]

My thanks to Alf and AZee....we are currently doing a network wide update of all distributed sniffers and console software..I was just informed. My desktop is going from 95 to win2k.