Symantec Management Platform (Notification Server)

i had a warning in Altiris log who tell me C:\ProgramData\Symantec\SMP\EventQueue is full,  But I see that there are disk space, but I also processes the .nse files for 15 days.

when i restart altiris client message dispatcher and i see the process stop :(

Can Anybody helpme with this error???

 

 

 

 

refer the following document http://www.symantec.com/business/support/index?page=content&id=TECH141400

you might try allowing the fast folder to process more events at one time the setting is in a file called coresettings.config and the value you will look for is <customSetting key="MaxConcurrentFastMsgs" type="local" value="24" />. I had to set mine to process 24 events at once to keep up with itself though you may not need that high of a setting. Aslo the altiris and altiris client message dispatcher service will need to be restarted to for any changes made to take effect.

Are you sure that this porblem es that???  i copy this log. Thanks!

 

Log File Name: C:\ProgramData\Symantec\SMP\Logs\a.log
Priority: 2
Date: 29/05/2012 01:28:45 a.m.
Tick Count: 1430957140
Host Name: ALTIRIS01
Process: w3wp (4868)
Thread ID: 3
Module: w3wp.exe
Source: Altiris.NS.EventRouter.ProcessAgentHttpPostEvent
Description: Event not processed. IP: 172.27.25.12; Error description: Altiris.NS.EventRouter+ServerBusyException: NS event queue 'C:\ProgramData\Symantec\SMP\EventQueue\EvtQFast' is full.
   at Altiris.NS.EventRouter.Deliver(Stream input, Boolean saveBadFiles, Boolean priority)
   at Altiris.NS.EventRouter.DeliverPostedDataImpl()
   at Altiris.NS.EventRouter.ProcessAgentHttpPostEvent()

 

 

Thanks!!!
 

 

Are you running 7.1 SP2?  There are some settings that did not get corrected in SP2 that can cause this issue.

Check the following registry entries:

HKLM\Software\Altiris\eXpress\Notification Server\MaxFileQEventCount

and

HKLM\Software\Altiris\eXpress\Notification Server\MaxFileQSize(KB)

I had to increase mine to 20000 and 14048000 respectivly.

 

This problem was solved restarting Altiris client Message Dispatcher an then restarting Altiris Service, before increase the HKLM\Software\Altiris\eXpress\Notification Server\MaxFileQSize(KB) to 2gb =) Thanks RahulG and JeffCarlson

Keep an eye on it for a few days.  Im curious if you are seeing the same issues we are seeing.  We have NSE files in the EvtQueue folder that never process.  We have a process we are doing everyday to clean out  the EvtQueue Folder and the EventQueueEntry table.  

I am working with Support on finding the root cause of the issue.

@JeffCarlson

Did you get any additional information from Support?

 

What steps are you performing daily to keep your queue clean and able to process?

For us there appears to be a link between IT Analytics and nse processing.  For the life of me I cant figure out how.  But if we turn off ITA processing, the number of issues are greatly reduced.  We were able to confirm that yesterday.

As for the process I do the following:

 

 

Stop the following services on SMP in this order:

                World Wide Web Publishing Service

                Altiris Support Service

                Altiris Service Hoster

                Altiris Service (stop dependent processes when prompted)

                Altiris Object Host Service

                Altiris File Receiver

                Altiris Event Receiver

                Altiris Event Engine

                Altiris Client Task Data Loader

                Altiris Client Message Dispatcher

 

Delete the following:

                delete files from c:\program data\Symantec\SMP\EventQueue\EvtQueue

                delete files and folders in c:\nse files\ (we turned on the option to keep bad nse files and store them here)

On the SQL Server:

                Start, All Programs, Microsoft SQL Server 2008 R2

                SQL Server Management Studio, windows authentication, connect

                New Query, select Symantec_CMDB

                truncate table EventQueue

                truncate table EventQueueStatus

                truncate table EventQueueEntry

                truncate table ResourceMerge

 

Back on the SMP

                restart services in the same order as well as any other Altiris marked as Automatic that arent running.

 

If you have ssetools from support, on the main page there is a Service Controler option.  If you launch that, you can change the drop down box to SQL Maintenance and then stop and start services from there.

When you have everything setup the way you want, you can restart and cleanup in about 2 minutes.  I have from time to time just moved the nse files for further study instead of deleting them.

This is pretty much the same basic steps that Support at Symantec has provided us, but we are only truncating 3 out of 4 of the tables you listed.  Support did not have us truncating the ResourceMerge table.

out of 3 of my SMP servers, we have 1 that is misbehaving and is not able to keep up with its own queue, and gets upwards of 2400+ file in it, and just cannot process large files in a timely manner.

the thing is, we can perform these very same steps, but we do not want to lose the NSE files that have not processed yet.  We off loaded them to another folder, and repopulating them into the eventqueue via the inbox, but we just cannot seem to catch up with processing current events as well as our other events that still have not been processed yet.

 

There is a KB article on this.  It seems to include running a couple of other SQL queries that may help.  I had to do all of this today on my environment.  Hopefully it helps...

http://www.symantec.com/docs/TECH183347