1. Initial Validation
Confirm reported disk usage on the affected server:
Verify C: drive free space (often near 0 GB).
Identify oversized files under:
C:\ProgramData\Liongard\Cache\
Confirm log file characteristics:
Log file is extremely large (100–200+ GB).
File cannot be opened due to size.
File cannot be deleted → error indicates file is in use.
2. Determine Log Ownership
Validate the log is not generated by the PowerShell install script:
Review script contents → no references to ProgramData logging.
Script transcript logs are typically small (KB range).
Conclude log is generated by the Liongard Agent / MSI install process, not the script itself.
3. Identify File Lock Source
Attempt to delete the log file:
Observe error: “File is open in Windows Installer.”
Attempt to stop Windows Installer service:
Service cannot be stopped (expected on servers).
Use Sysinternals Handle.exe:
Run elevated Command Prompt.
Execute:
handle.exe "C:\ProgramData\Liongard\Cache\<logfile>.log"Identify locking process:
MSEXC.exe (Windows Installer)
Capture PID for verification.
Example: tasklist /fi "PID eq 13720"
Example: handle.exe -c 318 -p 13720
Example: taskkill /PID 13720 /F
Agree to EULA–
May need to disable EDR if flags populate–
4. Release File Lock (No Reboot)
Reboot avoided due to file share server role.
Attempt to close the file handle using Handle.exe:
handle.exe -c <HandleID> -p <PID>Re-run handle command to confirm lock is cleared.
Delete the oversized log file.
Verify:
File is removed.
File is not in Recycle Bin.
5. Reinstall Liongard Agent (Clean)
Open PowerShell as Administrator.
Use official Liongard KB install script (not RMM-modified versions).
Populate required variables:
Instance prefix (e.g., US2)
API Token (required)
Agent Install Token
Environment name (exact match recommended)
Run script.
6. Handle MSI 1618 Error (If Encountered)
If install fails with:
MSI error 1618 – Another installation is in progressConfirm via:
agent-install.log
Event Viewer → Application → MSI Installer
If Windows Installer is stuck:
Identify MSEXC.exe PID.
Terminate process (last resort, ensure no other installs are running).
Re-run install script.
7. Token Validation (If Install Fails Again)
If agent registers partially but fails:
Reconfirm API token and Agent token values.
Generate new Agent Install Token.
Update script with new token values.
Re-run script → confirm success.
8. Post-Install Verification
Confirm:
Liongard Agent service is running.
Agent appears in Liongard UI.
Re-check:
C:\ProgramData\Liongard\Cache\Log files present but normal size (KB–MB range).
Review Event Viewer:
MSI 1618 entries correlate to earlier failure window.
No new repeating disk-space or installer errors.
9. Agent Auto-Update Confirmation
Verify scheduled task exists:
Liongard Agent Updater
Runs nightly (default behavior).
Confirm auto-update setting in UI:
Admin → Agents → Agent → Auto Update = Enabled
Inform partner:
Scheduled task alerts are expected.
Can be safely acknowledged or excluded in monitoring tools.
10. Root Cause (Operational Conclusion)
Windows Installer entered a stuck / locked state during agent install or update.
Liongard Agent logging entered a high-frequency retry loop.
Log file grew rapidly due to repeated MSI + disk-space errors.
File lock prevented cleanup until handle was forcibly released.
11. Follow-Up Actions
Monitor log size over next 24–72 hours.
Contact Liongard Support if log growth resumes.