We have the Windows Sensu client running on several 2008 R2 systems. One of our checks calls a batch file to gather some info and report back. We are sporadically receiving "Unknown: Unexpected error: Access is denied (5)" messages for these checks - no standard frequency, no correlation... the next check runs correctly without issue.
I've traced the call through the stack and the Sensu Ruby code) spawns the child process of 'cmd.exe /c "/path/to/batch.bat parameters"' without issue. I can recreate the issue by removing all NTFS access to the batch file itself. If you run cmd /c batch.bat with these permissions removed, it will return with that same "Access is denied (5)" error.
Ok, great, it's having issues accessing the file. Why? I've run process monitor traces and can find absolutely nothing wrong with the process: ruby loads up, cmd.exe is called, cmd.exe reads the file with no visible errors, then it returns the check as Access is denied. What the...?
I'm out of ideas. Some additional background info in case it helps: the ruby binaries are running as 32-bit; the Sensu client is the latest from the Sensuapp site; the system is running System Center Endpoint Protection. What am I missing??
This turned out to be a bug within the ChildProcess Ruby library and how it handled assigning the Windows Process to a Job object (race condition). I'll be sharing the fix with the author once I clean up the code.