We have some 7.8 clients which are broke due to a bad zmaster object. The zmaster.edm object on the client appears to have been stuck in the bootstrap process. I'm not sure why or even when this has occur, but the clients haven't processed a connect in over 35 days. We know if we replace the LIB\ZMASTER.edm with the SYSTEM\ZMASTER.edm and restart the services the client starts processing.
Attached you will find a good and bad zmaster object. What I'm looking to understand is how and when the LIB\ZMASTER.edm get's changed. Understanding this would help me to better understand what's causing the client to stop processing the connect.
The ZMASTER in the lib directory gets updated as a result of the agent conneect ( software, audit, patch, etc). If by just copying a different ZMASTER, agents work fine in your environment, you can compare the 2 objects.
To start with the CMD line and IPADDR values can give some clue.
Secondly, we could not see any attachment in the query.