When troubleshooting a difficult issue concerning the data path from the Altiris Agent to the Notification Server, by default individual row inserts are not captured. This is true for Inventory Solution, Patch Management's Inventory Rules data, Application Metering's Application Inventory, Software Delivery's Application Inventory, etc. The data trail can be traced through the NSE to the data loader, but at that point only reference to a bulk insert on a table is captured. How can each row-insert be recorded for scrutiny? This article is not for the light-of-heart.

Introduction

This article details the procedure for setting up the Notification Server so that when Notification Server Profiler is run it will capture each individual row insert for data being inserted into the Altiris database. Note that this will significantly increase the size of a profile trace, and should be used with caution and should not be implemented for any large length of time. Generally this is useful when following a specific data trail from a particular machine.

Note that this article assumes you have already followed the data trail from the client machine up to the Server and verified that the NSE that's posted to the queue has the expected data. If it does not, the issue is not with the data loader but with another process back down the data trail towards the client system.

All Event or Inventory type NSEs are broken into data fragments. The screenshot here shows a sample snippet from a Basic Inventory:

Click to view.

Use Cases

The following are a few use cases as examples of when this process would be valuable. Usage is not limited to this list.

• Inventory Solution data not updating in the database – We've seen cases where the NSE sent from a client machine has new data for a particular data class, but that data never makes it into the database.
  • Inv_AeX_SW_Audit_Software data class inserts multiple rows per resource, as with a few other data classes.
  • Other data classes mark the ResourceGuid column as key, and only one row will exist per resource. This is important to note if the NSE provides multiple rows for one of these types of data classes. Only the last row written will remain in the database.
• Software Delivery Reports are inaccurate – Based on the events being sent from target machines, we should have a more complete picture of how the task ran. To watch the events being inserted into the event tables, row inserts can be enabled.
• Incomplete data in the Altiris database – We've seen incomplete data in the tables for incoming inventory (of any type). Capturing row inserts helps paint a picture of what's occurring.
• All NSEs – Any NSE contains data that requires row-updates in the Altiris database, and this method can capture exactly how data is being inserted.

See the following diagram showing the breakdown of how data is loaded into the database:

Click to view.

Configuration Steps

The following process walks through how to enable row-insert capture for Notification Server with the Notification Server Profiler. Before following the steps, consider using the method to disable all natural processing of NSEs so that Profiler will only have insert data from the applicable NSEs.

Disabling incoming NSE transmission: The NS probably processed a handful of NSEs during the capture process unless you disabled the postevent.asp page so we'd only capture the applicable NSE insert. If you want to do this, follow these steps:

1. Note! Make sure no one is actively using Altiris as this will temporarily disable server.
2. Stop the Altiris Service. Do this by browsing to Administrative Tools and Services. Stop the service labeled 'Altiris Service'.
3. Stop IIS by stopping the service labeled 'IIS Admin Service'.
4. Browse on the Notification Server to Install_path\Program Files\Altiris\Notification Server\Agent\.
5. Rename the file Postevent.asp to PostEvent.asp.disabled.
6. Start up the Altiris Service and IIS (an iisreset will work).
7. Now complete the trace capture session as detailed below.
8. Warning! Do not forget to go back through steps 2 through 6, with the exception that step 5 should rename the file back to PostEvent.asp.

This process completely disables the ability for clients to post events and inventory to the Notification Server. Without backing out of the change, this NS will stay in this state and managed machines will begin to store their unsent NSEs. Do not keep this file renamed for long to avoid a heavy load when connectivity is restored.

Follow this procedure to capture the row inserts required:

1. Note! Make sure no one is actively using Altiris as this procedure will temporary disable the server.
2. On the Notification Server, browse to the location install_path\Program Files\Altiris\Notification Server\Config.
3. Make a copy of the file coresettings.config. Save the copy for backup purposes in case editor goes awry.
4. Open the file coresettings.config (Note! This should be opened in a true text editor as the formatting can be changed if saved improperly. One example is www.crimsoneditor.com).
5. Search the file for the string: AeXOledb
6. The following section contains the setting to edit:

   <!-- Disable AeXOledb COM component -->
   <customSetting key="DisableOledbConnection" type="local" value="0" />
    <customSetting key="ReportsUseApplicationIdentity" type="local" value="True" />
   </pre>
   <li>Change the value in the middle line to '1', as shown here:</li>
   <pre>
   <customSetting key="DisableOledbConnection" type="local" value="1" />
   
   

7. Save the changes to the file.
8. Restart the Altiris Service so the change is loaded into cache. Do this by browsing to Administrative Tools and Services. Restart the service labeled 'Altiris Service'.
9. Restart IIS. Do this by clicking on Start > Run > Type 'iisreset' (without quotes) > and Click OK.
10. Start Altiris Profiler from Start > Programs > Altiris > Diagnostics > Altiris Profiler.
11. Cancel out of the initial Wizard.
12. BEST PRACTICES: With the nature of the sheer size of profiled data, especially with row inserts enabled, it's recommended to run through the following process to capture the NSE you need before running Profiler.
    1. On the client machine where the data is originating from, go to Start > Run > Type in 'Regedit' (without the quotes) and click OK.
    2. Browse to HKEY_LOCAL_MACHINE | Software | Altiris | Altiris Agent | Transport | Capture Events Folder
    3. Modify the String value "Capture Events Folder" so that the Value data points to a directory or path wherein you want to capture a copy of all outgoing NSEs (ie: C:\CapturedNSEs)
    4. Close the Registry.
    5. Now reproduce the method that produces the NSE.
    6. Once complete, check the path and find the NSE. Once found, this NSE can be 'dropped' manually into the processing queues (evtqueue) at the time Profiler is running.
13. Click the green 'Play' button to start tracing as shown:
    

    Click to view.

14. Now duplicate the issue (Most of the time this will be sending Inventory to the server or dropping the problem NSE into the Evtqueue).
15. Once the data has been processed, stop the Altiris Profiler by clicking the red 'Stop' button.
16. Revert back the changes made to the CoreSettings.config file so the value is back to '0'.
17. Restart the Altiris Service and IIS as previously detailed.
18. Save the Profiler data by clicking on 'File', Export, and saving the .buffer file. This can be loaded back into profiler to review the trace data captured while processing the NSE.

Finding Row Inserts

Once the trace has been captured, it's now time to review the row inserts. Since trace captures so much data, it helps to know what to look for. Note the following identifiers for NSE processing:

• Process – AeXSvc
• Category – ClientMessageProcessing
• Sub-Category – ProcessFileCallback

For SQL:

• Process – AeXSvc
• Query – Begins with: 'INSERT INTO dbo.[Name_Of_Table...]'

Once you identify the insert statements you can view the nested SQL in the code trace to see what values are being inserted. This can be compared to the actual database using a SQL query to fetch the row shown to be inserted by the Profiler trace.

The following screenshot shows the SQL row for a Basic Inventory insert to the Inv_AeX_AC_Identification data class:

Click to view.

To the lower right of the screenshot a button labeled 'Move to Code' will switch the trace details to the code capture for the same SQL query selected in the list. See the following screenshot to see the resulting code window for this item. Specifically I've opened the Nested SQL from the tree and selected the row insert for Inv_AeX_AC_Identification.

Click to view.

The above data can now be compared to the database. It shows the table and the columns with values of what the Notification Server Data Loader inserted into the specified table.

Conclusion

This article focuses on capturing and reviewing what the data loader inserts into the database. This adds the ability to follow the data trail closely where the data loader is concerned. Hopefully this adds to your ability to troubleshoot data inconsistency problems between the client and the Notification Server.