24x7 ES Service start error

Hi
I'm trying to install 24x7 event server on my production machine, it's essentially a large sql box.
It installs with no error messages or anything but when I attempt to start the service it gives me a services error 1067: the process terminated unexpectedly.

In the application event log I get

An unhandled win32 exception occurred in 24x7es.exe [4560]. Just-In-Time debugging this exception failed with the following error: Debugger could not be started because no user is logged on.

Check the documentation index for 'Just-in-time debugging, errors' for more information.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

ES is configured as local system currently, I have tried starting it as an account.
Complicating matters is the fact that I really can't reboot this box.

Any ideas?

Can you start 24x7es.exe from the console with /c switch? Anything extra is printed to the screen?

24x7es /c

C:\Program Files\24x7 Event Server 2>24x7es /c
24x7 Event Server [Version 1.0.2065.0]
(C) Copyright 2003-2005 SoftTree Technologies, Inc.

Event server started... Press Ctrl+C to abort.

When I kill the process started with ctrl-c I get this error

It is a security issue. Your account has permissions to start 24x7 and read from the installed files, while the account selected for the service doesn't have them. Try choosing a different account for the service and see if the startup error disappears. At the very minimum the account should also have permissions to read/write to the event logs and to read from the registry from HKEY_LOCAL_MACHINE hive.

If you have the debugger, please open it and choose View/Call Stack or Debug/Call Stack wherever it is. This way we could see in which module(DLL) and function the error occurs, and if the function name is obvious, we might be able to figure out what it was doing at the time of the crash.

Call stack output;

> 00384488()
kernel32.dll!77e77e24()
[Frames below may be incorrect and/or missing, no symbols loaded for kernel32.dll]
kernel32.dll!77e64829()
kernel32.dll!77e77d99()

The accounts that I've tried are local system and a local admin account; no change.

Here's the visible error

It is trying to call some kernel function passing an invalid parameter value. Not enough to figure out the root cause. I'd like to suggest finding the offending event or events and continuing from there when it is know what these events are for and what level of access they need. Create a copy of the 24x7es.ini file with a different name and test different file content, removing events one by one until the offending events are found. To simplify the process, you can start 24x7 from command line with an additional /f switch following by the test .INI file name

24x7es /c /f test24x7es.ini

There is nothing in the 24x7es.ini except for the globals and logging parameters; this is a virgin install of ES. No jobs are defined in the GUI.

I'm not sure what else to suggest to try.

I'm going to log this case to support system for further investigation.

Please provide the following information to the support.

1. Start 24x7es /c
2. Close it using Ctrl+C. When you get Visual Studio debugger prompt, please accept it.
3. In the debugger click Save Dump on the Debug menu to save a minidump of the crashed code.
4. Zip the resulting file and email to our support account.

Ok after some further investigation this is caused by incompatibility with windows server 2003 R2; the product installs and works fine on on 2003 non-r2.

I imagine you'll need to release a new version.

Thanks for the info. We will look into this issue.

Hi guys
are you able to offer any sort of timeframe on the release of a version of Event server that will work with Windows Server 2003 R2? We were wanting to use the product on a new system of ours but have been stymied by this.
Thanks