Symantec Management Platform (Notification Server)

Hi,

The above message keeps appearing in error log.
The EvtQFast directory is full with *.tmp file.
There are about 5 files per second over a one day period.

I deleted all the files, restart NS and it will be ok for one day.
Then the files will appear again.

I have already check KB28852 and found the setting to be 0.
I have already done KB2880 but no avail.

My environment is

NS 6.0.6074 SP3 R8

Only Patch and Inventory is in use.

Please help.

Check your Altiris logs on the server. What do they say? Feel free to post them here in .zip format.

I did a further check on the system log and found the following:

At 5am daily.

1. Altiris service is stopped.
2. Altiris Client Message Despatcher is stopped as a result of dependency on Altiris service.
3. Altiris service is started.
4. However, Altiris Client Message Despatcher did not start.

No information was provided why despatcher was not started.

I have set the despatcher service recovery to restart when stop.

Will monitor the situation further.

Thanks.

David,
The Altiris logs (not the Microsoft logs) should provide some insight. However, when these services fail, typically it it because the event queues become overloaded. Let us know how it goes.

Cheers,

Jim

Hi Jim,

Attached is the log file.

You can find the error message at 5:06:23

Unable to start service "AeXSvc". Error 5b4.

Thanks

Ok the errors start at 5:00:08 with thisescription: Failed to process schedule '4754ff9c-911b-4d67-9eb0-4d530fb456ab'. Exception: '?', hexadecimal value 0x04, is an invalid character. Line 756, position 93.

Check the scheduled task at control panel\tasks to see what that GUID is referring to. It sounds like the schedule is set to to something that Altiris cannot determined.

Then after that, at 5:04:58 the services are attempting to stop, and seem to do so. Then at 5:05:41 it looks like something is forcing the Altiris service (forcible termination) to stop, and then the WW3 svc (IIS\web) stops.

I'm curious as to what would be forcing these services to shut down. I've seen Altiris do this when the event queues get overloaded, but the log doesn't indicate a bunch of data coming in.

What hardware is your server on (memory, CPU, OS, and is the SQL server on box)?

At 5.00am, NS.NS Log Archive Schedule with this GUI starts '4754ff9c-911b-4d67-9eb0-4d530fb456ab'.

Memory - 1GB; OS - Windows 2003 Standard; CPU - P4 2.8Ghz; SQL - on box.

With SQL on box, 1GB is not nearly enough memory. The OS reserves (by default) 2GB for itself, unless you implement the /3GB switch in the boot.ini - which requires a minimum of 4GB of memory.

So you probably are seeing alot of swapping and other performance issues.

With budget constraint, this is all I have.
I have been running with this config for almost 3 years now and this is the first time this has happen.
Upgrade aside, is there anything else that is wrong?

Thanks

Not that I can see. You could limit the number of files in the queue total and the number that can be processed, which can be done manually or preferably by using the NS Configurator. This must be installed manually, and the .msi should be in the program files\altiris\diagnostics folder.

Also, do you have the 6.5 console installed?

I had a similar problem with those services stopping and the queues overflowing. In my case, it was Package Status events. I went into my packages and tasks and turned off the Verbose option and haven't had a problem since.

Thanks rlgura for providing that. That has to be done per package, so if you have alot it may be time consuming, but it's a great idea. If you look under Configuration -> Altiris Agent -> Global Altiris Agent Settings -> Events tab, you can deselect events you don't care about there.

The only ones I make mandatory are the AeXSWD Execution, and perhaps the package server status and discovered applications, if you are using App Metering and have that configured.

For my case, it is the client message dispatcher service that get stop for unknown reason at 5.00am daily.
This is causing the queue to fill up.

I put in a schedule job every day to start the service at 6.00am.
So far, this is working fine and all the events are processed on a timely manner.

Thanks