Event Server configuration:
Ports listed by netstat -aon | find “”:
TCP 0.0.0.0:1234 0.0.0.0:0 LISTENING 2708
TCP 0.0.0.0:9090 0.0.0.0:0 LISTENING 2708
TCP 10.65.31.103:443 10.65.63.117:52708 ESTABLISHED 4
TCP 10.65.31.103:49339 10.65.31.196:1433 ESTABLISHED 2708
TCP 10.65.31.103:49345 10.65.31.196:1433 ESTABLISHED 2708
TCP 10.65.31.103:49346 10.65.31.196:1433 ESTABLISHED 2708
TCP 10.65.31.103:49357 10.49.22.2:7563 ESTABLISHED 2708
TCP 10.65.31.103:49358 10.65.41.101:7563 ESTABLISHED 2708
TCP 10.65.31.103:49359 10.65.80.25:7563 ESTABLISHED 2708
TCP 10.65.31.103:49361 10.65.2.81:7563 ESTABLISHED 2708
TCP 10.65.31.103:49362 10.65.51.101:7563 ESTABLISHED 2708
TCP 10.65.31.103:49363 10.48.224.67:7563 ESTABLISHED 2708
TCP 10.65.31.103:49365 10.49.6.21:7563 ESTABLISHED 2708
TCP 10.65.31.103:49366 10.65.71.101:7563 ESTABLISHED 2708
TCP 10.65.31.103:49367 10.65.61.101:7563 ESTABLISHED 2708
TCP 10.65.31.103:49401 10.65.31.12:389 ESTABLISHED 2708
TCP 10.65.31.103:49404 10.65.31.12:389 ESTABLISHED 2708
TCP 10.65.31.103:49418 10.65.31.196:1433 ESTABLISHED 2708
TCP 10.65.31.103:49419 10.65.31.196:1433 ESTABLISHED 2708
TCP 10.65.31.103:49420 10.65.31.196:1433 ESTABLISHED 2708
TCP 10.65.31.103:49421 10.65.31.196:1433 ESTABLISHED 2708
TCP 10.65.31.103:49422 10.65.31.196:1433 ESTABLISHED 2708
TCP 10.65.31.103:49938 10.51.16.71:7563 SYN_SENT 2708
TCP 127.0.0.1:49927 127.0.0.1:60000 ESTABLISHED 2708
TCP [::]:9090 [::]:0 LISTENING 2708
TCP [::1]:49334 [::1]:80 ESTABLISHED 2708
TCP [::1]:49397 [::1]:22331 ESTABLISHED 2708
TCP [::1]:49407 [::1]:22337 ESTABLISHED 2708
TCP [::1]:49408 [::1]:22337 ESTABLISHED 2708
TCP [::1]:49409 [::1]:22337 ESTABLISHED 2708
UDP 0.0.0.0:1234 *:* 2708
UDP 127.0.0.1:50036 *:* 2708
I reviewed Event Server logs from locations
C:\ProgramData\Milestone\XProtect Event Server\logs
and
C:\ProgramData\Milestone\XProtect Event Server\logs\MIPLogs
It looks like I noted version wrong and it is Professional+ 2020R1, not 2022:
2023-10-05 00:00:00 UTC-03:00 Info Log -------------------------- Version: 20.1.26.1
2023-10-05 00:00:00 UTC-03:00 Info Log Available MAC address:<MAC ADDRESS>
2023-10-05 00:00:00 UTC-03:00 Info Log Local time is now: 00:00:00
2023-10-05 00:00:00 UTC-03:00 Info Log UTC time is now: 03:00:00
I didn’t find any suspicious logs, only the ones that caught my attention:
2023-10-06 02:34:47 UTC-03:00 Error StatusSessionRecorder Error communicating with: sthmer0801.d1.ad.local:7563 with message: No connection could be made because the target machine actively refused it 10.51.16.71:7563
Exception details:
System.Net.WebException: Unable to connect to the remote server ---> System.Net.Sockets.SocketException: No connection could be made because the target machine actively refused it 10.51.16.71:7563
at System.Net.Sockets.Socket.DoConnect(EndPoint endPointSnapshot, SocketAddress socketAddress)
at System.Net.ServicePoint.ConnectSocketInternal(Boolean connectFailure, Socket s4, Socket s6, Socket& socket, IPAddress& address, ConnectSocketState state, IAsyncResult asyncResult, Exception& exception)
--- End of inner exception stack trace ---
at VideoOS.Event.Server.Communication.Corporate.RecorderStatusService2Central.CheckTokenRefreshOrRethrowException(Exception e)
at VideoOS.Event.Server.Communication.Corporate.RecorderStatusService2Central.StartStatusSession()
at VideoOS.Event.Server.Communication.Corporate.StatusSessionRecorder.Run()
2023-10-06 04:48:49 UTC-03:00 Error StatusSessionRecorder Error communicating with: sthsfo0810.d1.ad.local:7563 with message: An existing connection was forcibly closed by the remote host
Exception details:
System.Net.WebException: The underlying connection was closed: An unexpected error occurred on a receive. ---> System.IO.IOException: Unable to read data from the transport connection: An existing connection was forcibly closed by the remote host. ---> System.Net.Sockets.SocketException: An existing connection was forcibly closed by the remote host
at System.Net.Sockets.NetworkStream.Read(Byte[] buffer, Int32 offset, Int32 size)
--- End of inner exception stack trace ---
at System.Net.Sockets.NetworkStream.Read(Byte[] buffer, Int32 offset, Int32 size)
at System.Net.PooledStream.Read(Byte[] buffer, Int32 offset, Int32 size)
at System.Net.Connection.SyncRead(HttpWebRequest request, Boolean userRetrievedStream, Boolean probeRead)
--- End of inner exception stack trace ---
at VideoOS.Event.Server.Communication.Corporate.RecorderStatusService2Central.CheckTokenRefreshOrRethrowException(Exception e)
at VideoOS.Event.Server.Communication.Corporate.RecorderStatusService2Central.GetVideoDeviceStatistics(Guid[] ids)
at VideoOS.Event.Server.Communication.Corporate.StatusSessionRecorder.Run()
I feel like they are not case here.