Audit Monitor Service Fails to Start

Audit Monitor Service Fails to Start

Problem

After installing Audit Monitor, the Audit Monitor service fails to start.

An error message is displayed when starting the service:

Services - The HCI SSO Audit Monitor Service services on the Local Computer that started and then stopped. Some services stop automatically if they are not in use by other services or programs.

The Audit Monitor logs located in “C:\ProgramData\HealthCast\Audit Monitor\logs” show an error similar to the one below:

2020-07-16 13:44:49.150 -05:00 [Information] Listening on prefix: https://+:5000/
2020-07-16 13:44:49.150 -05:00 [Error] Start
Microsoft.Net.Http.Server.WebListenerException (0x80004005): The process cannot access the file because it is being used by another process
at Microsoft.Net.Http.Server.UrlGroup.RegisterPrefix(String uriPrefix, Int32 contextId)
at Microsoft.Net.Http.Server.UrlPrefixCollection.RegisterAllPrefixes(UrlGroup urlGroup)
at Microsoft.Net.Http.Server.WebListener.Start()

POSSIBLE CAUSE 1: The default Audit Monitor port (5000) is being used by another program

To verify whether port 5000 is being used by another program:

1. Open a command window as a local administrator
2. Run the following command
   1. netstat -ab > “c:\netst.txt”
3. Open the generated file (netst.txt)
4. Search for “:5000”
   1. If you find a line that includes port 5000, another program is using that port
      

RESOLUTION 1: Configured Audit Monitor to use a port other than 5000

1. In this example, we will be configuring the Audit Monitor service to use port 6000
2. Verify that the port you are planning to use is not already in use
   1. Open a command window as a local administrator
   2. Run the following command
      1. netstat -ab > “c:\netst.txt”
   3. Open the generated file (netst.txt)
   4. Search for “:6000”
   5. If you do not find “:6000”, port 6000 should be safe to use
3. Open the firewall for the port, reserve the URL prefix, and assign an SSL certificate
   1. NOTE: These steps assume you are updating a saved version of the modified SsoAuditMonitorSetup.ps1.
      1. Run PowerShell ISE as a local administrator
      2. Open the C:\Program Files (x86)\HealthCast\SSO Audit Monitor\Config\SsoAuditMonitorSetup.ps1 file
      3. Modify the Port value to 6000.
         
      4. Run the script
4. Update the SSO Audit Monitor JSON File to use port 6000
   1. Open the C:\Program Files (x86)\HealthCast\SSO Audit Monitor\Config\appsettings.json file in Notepad (or another text editor)
   2. Modify the “server.urls” setting so that it is using port 6000
   3. 
      
   4. Save the file.
5. Try starting the Audit Monitor service.
   1. Unless there are other configuration problems, the service should start and run without generating any errors
      

POSSIBLE CAUSE 2: The configured certificate does not have the FQDN of the server

In order for Audit Monitor to work properly, there must be a server certificate installed that has the Fully Qualified Domain Name as the subject field (see https://hc-admin.idauto.net/en/system-requirements-284247.html):

RESOLUTION 2: Obtain a certificate that has the FQDN of the server as the Subject

1. Obtain a certificate that has the FQDN of the server as the Subject and configure Audit Monitor to use that certificate.