What to do when you are unable to kill a job or read its output in Control-M Version 8.
Last night I had the very annoying happening when I was building some test jobs in Control-M. The test jobs were pointed to an agent where the jobs would be executing the scripts directly on the Control-m agent. I ordered the jobs into the Monitoring environment and let them to run in the order that I created them in their workflow. Job 1 was only supposed to run for 1 minute. It ended up running for 5 minutes. I immediately knew something was wrong. When I attempted to read job 1’s output I was unable to retrieve this from the job. I also tried to kill the job. This action was rejected by Control-M. I started to panic because I had never seen this before. I had job 1 set to run all day so I changed it to stop running in one minute. It stopped running and failed. I extended the time a few minutes and tried to re-run it again. It resulted in the same issue as before. This time I killed the services on the agent and rebooted it. This sent the job into a unknown state. That didn’t help.
I then decided to go to the agent that was to execute this job and went to the following path \Program Files\BMC Software\Control-M Agent\Default\PROCLOG\. In the PROCLOG folder I started looking the logs that started with AM_SUBMIT*. And look for logs that were created around the same time my job was created. I also searched within the AM_SUBMIT* log with my the job ID given to the job when it was ordered into the Control-M Monitoring environment. (The job ID is in the Synopsis area for the job) This reassured me I was in the correct log. I scanned for errors and found the following ,“CreateProcessAsUser failed with error: 1314 – A required privilege is not held by the client”, and immediately went to the BMC website and went to the Support Central area. I then started looking through the Knowledge Articles for this errors. Luckily I wasn’t the only Control-M admin to run across this issue.
To resolve this problem, you need to increase the rights of the job owner, adding the “Replace a process level token” permission. To do so, please follow the following instructions:
1) Open the Control Panel / Administrative Tools / Local Security Policy
2) Add to the job owner user account the “Replace a process level token” right. (You may have to logout or even reboot to have this change take effect.)
If another user account other than the “Local system account” is defined under the “log on” tab of the Control-M/Agent service, then the account should be member of the local admin group and have the following rights:
Local Security Settings:
> Adjust memory quotas for a process
> Replace a process level token
> Log on as a service
AND
List Folder Contents permissions for the agent drive
I was fortunate because all I needed to was add the “Replace a process level token” right for my control-m account that was executing the jobs on that server. Then I rebooted. After I did this I immediately re-ran my job and it worked properly and returned a output. I proceeded to execute the other test jobs and they all worked correctly. Problem solved.
AlexSalyer 