ATA Gateway service won't start

Question

Hi. After installing the gateway on the server, the service does not start. errors appear in the event log:
The Microsoft Advanced Threat Analytics Gateway service terminated unexpectedly. It has done this 252 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.

Logs from Microsoft.Tri.Gateway-Errors
2022-04-14 04:54:20.1410 5808 5 Error [WebClient+<InvokeAsync>d__8`1] System.Net.Http.HttpRequestException: PostAsync failed [requestTypeName=CreatePerformanceCounterCategoryRequest] ---> System.Net.Http.HttpRequestException: An error occurred while sending the request. ---> System.Net.WebException: The underlying connection was closed: An unexpected error occurred on a receive. ---> System.IO.IOException: Unable to read data from the transport connection: An existing connection was forcibly closed by the remote host. ---> System.Net.Sockets.SocketException: An existing connection was forcibly closed by the remote host
at System.Net.Sockets.Socket.EndReceive(IAsyncResult asyncResult)
at System.Net.Sockets.NetworkStream.EndRead(IAsyncResult asyncResult)
--- End of inner exception stack trace ---
at System.Net.Security._SslStream.EndRead(IAsyncResult asyncResult)
at System.Net.TlsStream.EndRead(IAsyncResult asyncResult)
at System.Net.Connection.ReadCallback(IAsyncResult asyncResult)
--- End of inner exception stack trace ---
at System.Net.HttpWebRequest.EndGetResponse(IAsyncResult asyncResult)
at System.Net.Http.HttpClientHandler.GetResponseCallback(IAsyncResult ar)
--- End of inner exception stack trace ---
at async Microsoft.Tri.Common.Communication.WebClient.PostAsync
at async Microsoft.Tri.Common.Communication.WebClient.InvokeAsync
--- End of inner exception stack trace ---
at async Microsoft.Tri.Common.Communication.WebClient.InvokeAsync
at async Microsoft.Tri.Common.Communication.WebClient.InvokeAsync
at async Microsoft.Tri.Gateway.Communication.PerformanceCounterCategoryManagerProxy.CreateAsync(?)
at async Microsoft.Tri.Infrastructure.Framework.PerformanceCounterManager.OnStartAsync(?)
at async Microsoft.Tri.Infrastructure.Framework.Module.StartAsync(?)
at async Microsoft.Tri.Infrastructure.Framework.ModuleManager.OnStartAsync(?)
at async Microsoft.Tri.Infrastructure.Framework.Module.StartAsync(?)
at async Microsoft.Tri.Infrastructure.Framework.Service.OnStartAsync(?)
at Microsoft.Tri.Infrastructure.Framework.Service.OnStart(String[] args)

how to fix the error?

Answer 1

That won't be easy, I suggest to open a support case and have an engineer escort you with this.

Answer 2

The gateway is asking the updater to create performance counters and fails.
Check the updater log for a matching error to see why it failed answering the request.

Answer 3

2022-04-14 05:19:23.6513 4524 37 Warn [OwinContextExtension] Sending retry request [Client certificate doesn't exist]
2022-04-14 05:19:23.6513 4524 37 Error [ExceptionFilterStream] System.IO.IOException ---> System.Net.HttpListenerException: An operation was attempted on a nonexistent network connection
at System.Net.HttpResponseStream.Write(Byte[] buffer, Int32 offset, Int32 size)
at Microsoft.Owin.Host.HttpListener.RequestProcessing.ExceptionFilterStream.Write(Byte[] buffer, Int32 offset, Int32 count)
--- End of inner exception stack trace ---
at Microsoft.Owin.Host.HttpListener.RequestProcessing.ExceptionFilterStream.Write(Byte[] buffer, Int32 offset, Int32 count)
at Microsoft.Tri.Common.Extensions.OwinContextExtension.ReturnRetryRequest(IOwinContext owinContext, String errorMessage)
at async Microsoft.Tri.Common.Management.AppBuilderExtension.<>c__DisplayClass3_0.<UseCertificateValidation>b__0(?)
at async Microsoft.Owin.Security.Infrastructure.AuthenticationMiddleware`1.Invoke
at async Microsoft.Tri.Common.Management.AppBuilderExtension.<>c.<UseExceptionHandler>b__2_0(?)

Answer 4

Try to uninstall and reinstall the gateway. if you get the same pair of errors, check in certlm.msc if you have the ATA Gateway cert in the store.
If yes, my guess is that you have something that is interrupting the TSL localhost communication on port 444 which breaks the certificate based authentication.

Answer 5

reinstalled, same error. There is a certificate. on ATACentre, netstat does not show that port 444 is waiting for a connection.