In some situations, Network Agent stops working and fails to restart on Windows. This may be because the pcap driver (either Npcap or WinPcap) has been removed or has malfunctioned. In such cases, the Network Agent logs include the IstallInfo: appName: serviceName:no-pcap message:
Example error indicating a missing or faulty pcap driver
2022-05-18 20:11:07.744 UTC [00003e90] info [native] NetworkAgent::init:318: Running with IstallInfo: appName: serviceName:no-pcap dllPath:C:\Windows\system32 isInstalled:0 isRunning:0 isError:1
2022-05-18 20:11:07.744 UTC [00003e90] info [native] NetworkAgent::init:320: IstallInfo: appName: serviceName:no-pcap dllPath:C:\Windows\system32 isInstalled:0 isRunning:0 isError:1
2022-05-18 20:11:07.744 UTC [00003e90] info [native] NetworkAgent::init:321: Pcap not operational, Network Agent will shutdown gracefully
2022-05-18 20:11:07.744 UTC [00003e90] info [native] NetworkAgent::~NetworkAgent:136: pktReader.finalize()
2022-05-18 20:11:07.744 UTC [00003e90] info [native] NetworkAgent::~NetworkAgent:139: delete pcapIfc
2022-05-18 20:11:07.744 UTC [00003e90] info [native] DataReporter::~DataReporter:104: DataReporter::~DataReporter
2022-05-18 20:11:07.744 UTC [00003e90] info [native] pkt_analysis::SessAnalyzer::~SessAnalyzer:210: Session insert counter=0, session remove counter=0
2022-05-18 20:11:07.744 UTC [00003e90] info [native] ... last message repeated 2 times ...
2022-05-18 20:11:07.744 UTC [00003e90] info [native] Agent::~Agent:950: delete mTimeProvider
2022-05-18 20:11:07.744 UTC [00003e90] info [native] Agent::~Agent:952: delete mconfig
2022-05-18 20:11:07.744 UTC [00003e90] info [native] Agent::~Agent:955: delete mlog
In such cases, Network Agent is repeatedly restarted by OneAgent Watchdog, but exits early without providing network metrics. In OneAgent versions earlier than 1.241, it also resulted in multiple Network Agent segmentation faults due to flawed error handling logic. Since OneAgent version 1.241, however, Network Agent initialization failure no longer results in a segmentation fault.
To verify that at least one pcap driver is installed, execute the driverquery command. If the driver is not installed, it will be installed automatically during the next upgrade.
