Symantec Management Platform (Notification Server)

Environment: W2K3R2SP2 update, SQL2kSP4 updated; NS6SP3R10

Comming in this morning the log gave me following:

Failed to process schedule '4754ff9c-911b-4d67-9eb0-4d530fb456ab'. Exception: '?', hexadecimal value 0xAB, is an invalid character. Line xxxx, position 93.

Where 0xAB and xxx have different values:
April 25th: 0x18, 896
April 26th: 0x1A, 2006
April 27th: 0x18, 930

I have looked at the ItemBrowser for all (4) occassions and these seem to be excatly the same.
I have searched the database for the GUID (representing NS Log Archive Schedule) and have looked in every table it is found. Eventhough I am not able to dig deep in this area, i "just" looked around to see if I could see something strange myself.

Looking at the Evt_NS_Log  the last _eventtime was april 24th this year.

Starting this task manually, generates just another entry of the same.

Anybody suggestions on this?

Guido

or even the schedules under control panel scheduled tasks. Each schedule should have a guid. In any case, typically I've seen this issue where the name of the schedule has a 'special character' in the name.

Thx Jim for your reply.  I had checked this already.

What I did yesterday:
- removed the Scheduled task and restored it back from [recycle bin]
- changed the "Stop the task if it rubs for" from 72 to 23 hours
Checked this morning, worked like a charm
Log files are removed from the file system and Evt_NS_Log contains those records...

"Solution" is to simple, but this worked.

I should have tied your topic title to the schedule. I know that log archiving isn't always considered a best practice, but a built in schedule shouldn't have any issue.

Hi Jim,

May I ask you to go more into detail on this. Why, workaround, what is best-practice, etc...

Thx in advance

Originally, it was stated that archiving caused unnecessary table growth. I just need to back that up now! I see your issue is actually a known problem see: Altiris KB40421.

The main issue stated with log archiving was that it stored the data in a database table that wasn't easily managed. So, in my case, I do 'self archiving', or keep interesting logs in a separate folder.

In any case, if the table size isn't a problem, I would continue doing what you were doing. I was hoping the General Q & A on log files would hold the answer, but it does not.

Hi Jim,

Take down the flags, error returned this morning.

I'd read the Q&A already before.  But Looking at the KB you mention, mine looks the same with two diffs:
In KB Process: aexsvc.exe (404) and in mine Process: aexsvc.exe (1168)
In KB exists, not in mine: at System.Xml.XmlScanner.ScanCData()

I have now four lines now visual.  Two of them did the default 05:00 schedule (Where can I change that?).  They have also excactly the same hexadecimal value that seems to be the problem 0x18 (=24, no link to 05 or 17)

I am in the proces of building the environment. There are only three clients. New issue to me.
Tablesize is not an issue. Also Altiris is used to have one tool - one goal. Do not want to create self-made archiving scripts etc... Not yet anyway.
Any more thoughts or should I bring this to support?

Regards (and thx!)
Guido

As the error kept on coming, and second thought/descision to keep log-files out of the database, I made following cmd file that did the trick for me:

SETLOCAL
CLS
GOTO Script

::ScriptHeader
:: ====================================
::
:: Program name: ArchiveNSLogFiles.cmd
:: Version: 1.0.1
::
:: Infolink Consultancy BV - Netherlands
::
::   v1.0.0 Guido Langendorff - 20090508
::      Initial setup
::   v1.0.1 Guido Langendorff - 20090511
::      Cosmetic adjustments
::
:: Syntax: ArchiveNSLogFiles.cmd
:: Parameters: None
::
:: Tested on: Windows XP SP2; Windows 2003 R2 SP2,
::
:: Purpose
:: On some occassions buildin LOG archiver fails (scheduled task gives error)
:: This script also keeps data out of database
:: ====================================

:Script

:: User Variables to set
:: =====
:: Set MaxFile value. Not found a way to extract from Registry as it is a Hex value
:: -----
REM See "HKLM\Software\Altiris\eXpress\Event Logging\Logfile\MaxFiles"
SET MaxFiles=50

:: Change this to the path you like
SET ArchivePath=D:\Install\ArchiveLog
IF NOT EXIST "%ArchivePath%" md "%ArchivePath%"

:: System Variables. Please do not change below unless you are sure
:: =====

:: Define query to the Registry to get the present path for S logging
:: -----
SET QueryCommand=REG QUERY "HKLM\Software\Altiris\eXpress\Event Logging\Logfile" /v FilePath

:: Running Query to the Registry to get the Altiris installation/log path
:: -----
FOR /F "usebackq tokens=2*" %%Q in (`%QueryCommand%`) DO SET AltirisLogPath=%%R

:: Creating day-stamp in proper order (yyyyymmdd) so folders are in correct order
:: -----
SET Year=%Date:~-4,4%
SET Month=%Date:~-7,2%
SET Day=%Date:~-10,2%
SET DayName=%Date:~0,2%
SET DateStamp=%Year%%Month%%Day%

:: Check if exist and if not create the folder to archive all the NS Logs
:: -----
IF NOT EXIST "%ArchivePath%\%DateStamp%\a*.log" MD "%ArchivePath%\%DateStamp%"

:: Copy NS Log files to Archive. If exist in Archive the originals are removed
:: -----
FOR /L %%N in (1,1,%MaxFiles%) DO (
    IF EXIST "%AltirisLogPath%\a%%N.log" COPY /Y "%AltirisLogPath%\a%%N.log" "%ArchivePath%\%DateStamp%"
    IF EXIST "%ArchivePath%\%DateStamp%\a%%N.log" DEL /Q "%AltirisLogPath%\a%%N.log"
)

:: Cleaning
:: -----
SET ArchivePath=
SET QueryCommand=
SET AltirisLogPath=
SET MaxFiles=
SET Year=
SET Month=
SET Day=
SET DayName=
SET DateStamp=

:EOS
:EOF

Hope it is of any use for you

Guido