Avast rebooting critical servers mid day

[mschedler1]

I have our servers set to manually update for this very reason. 40+ users logged in and it rebooted my most critical servers for no apparent reason! I don't get it!

How am I supposed to prevent Avast from blowing out our main ERP system in the middle of the day???

[mschedler1]

There were at least 20 users logged in at the time these Avast log entries were recorded (same thing with the other two servers):

[2022-08-04 18:21:15.768] [info   ] [UI         ] [ 3120: 3108] Restart UI::HandleRestartRequest: Reboot request from a service
[2022-08-04 18:21:15.784] [error  ] [UI         ] [ 3120: 3108] Restart UI::HandleRestartRequest: No user is logged in, performing the action immediately
[2022-08-04 18:21:15.784] [info   ] [UI         ] [ 3120: 3108] Restart UI::PerformReboot: Reboot from a service
[2022-08-04 18:21:16.815] [info   ] [UI         ] [ 3120: 3108] Restart UI::HandleRestartRequest: Reboot request from a service
[2022-08-04 18:21:16.815] [error  ] [UI         ] [ 3120: 3108] Restart UI::HandleRestartRequest: No user is logged in, performing the action immediately
[2022-08-04 18:21:16.815] [info   ] [UI         ] [ 3120: 3108] Restart UI::PerformReboot: Reboot from a service

In US Central time, that's 1:21 in the afternoon.

[Jeff.S]

Hi,

I would recommend submitting a support ticket so that we can collect logs from a device that had the issue. A device running a server OS shouldn't reboot automatically as it seems to have done. I would recommend setting program updates to manual and scheduling those when you have a maintenance window in case issues like this happen.

[mschedler1]

I do already have the servers set to manual for this very reason (Avast has rebooted my terminal servers mid-day several times before).

This time, however, I have more information. It appears from what I see in "restarts.log" and user reports that the Avast update identified a single person out of the twenty or so who were logged in, and only considered that single person when determining when it was safe to reboot. Despite the fact that there were multiple users still logged in and working (not idle), the moment that one single user logged out, it mistakenly identified that there was no one logged in and the reboot was triggered.

If Avast would simply test the scenario, they'd likely find the issue themselves. I've already decided to look elsewhere for an Anti-virus solution since Avast seems to have lost their way and are stumbling blindly into more and more mistakes and fixing very little.

I see updates are rolling out on our systems today... I'm watching carefully and hoping it doesn't blow up again... a great way to spend my day. 

[Brett12]

I'll throw my hat in with this exact issue as well,
Just dropped a support ticket to report that my server has been restarting without permission from myself.

Even Windows Update doesn't restart the server without me directly requesting.

I believe the first instance we noticed it restart was Thursday the 1st of September at 4pm, this is the time the bulk of our data entry comes in and I began receiving calls saying people are getting thrown out.
I find i was unable to RDP to the server and instead had to use the KVM to see what was going on. I find the server mid restart and has now decided to do the windows update which was supposed to happen on the saturday.
So 45minutes later, the server finally settles down to where I can access the drives and work can now start.

Monday the 12th of September around 8am, I'm informed that people cannot access the server again. I take a look, the server had restarted. I had disabled automatic windows updates so no more long waits.
Today (Tuesday) 13th of September around 8am, once again I see the server has restarted.... I need to completely stop Avast from initiating a restart. Either give me the option to schedule periods where it is not critical or make it so I must manually install these updates.

[Stephen D]

We released an emergency update today that required a restart. If you have critical servers that cannot restart please reinstall the Antivirus on the devices and that should stop future restarts.

[mschedler1]

And of course we've now gone the opposite direction. NONE of my systems are rebooting to finish updates at all. We've had two updates needing a reboot in the last three weeks and I've had to restart everything manually... I guess that's what I'll be doing tonight instead of going home.

Smashing.