NS Event Queue (EvtQFast) is full - returning BUSY

Products

• IT Management Suite

Issue/Introduction

Generally the error message is found in the logs, but this will cause various issues due to incoming events staying unprocessed in the Notification Server. These are some of the symptoms of this issue. Note that these symptoms may have other causes:

• The errors about queue being full in Notification Server log files
• Errors about queue being full in Agent logs on client computers
• HTTP 503 errors while trying to post information to Notification Server in Agent logs on client computers
• Inventory is running  but no information is found in the Console - Notification Server has not processed Inventory information from client Agents
• Packages not downloaded to client machines due to "No package sources returned by server" - Notification Server has not processed content updates from Package Servers

Other possible errors:

NS Event Queue (EvtQFast) is full - returning BUSY
PostFile to 'http://Notification.Server.Name/Altiris/NS/Agent/PostEvent.asp' failed: HTTP error: 503 Service overloaded (-2147213300)
Error while downloading package: No package sources returned by server (-2147023728)

Environment

8.x

Resolution

Please follow these steps:

1. Make sure Altiris services are started. If they are started, try restarting these.

2. If services are started, please remove all files from EvtQFast folder (C:\Program Files\Altiris\Notification Server\NSCap\EvtQFast). Generally, deleting these files is OK, as Agents will simply resend most of the information. If you do not want to delete these, move files to another location and move them back in small batches after queue processing is confirmed to be working again.

3. There are a few registry keys that should be checked if services are running, files have been cleaned out but events are still not processed. All the following registry keys should normally be set to 0. Please check the related articles for more details on these registry keys.

HKEY_LOCAL_MACHINE\SOFTWARE\Altiris\eXpress\Notification Server\FlushAgentEvents
HKEY_LOCAL_MACHINE\SOFTWARE\Altiris\eXpress\Notification Server\EvtQFastFull
HKEY_LOCAL_MACHINE\SOFTWARE\Altiris\eXpress\Notification Server\PauseActivities
HKEY_LOCAL_MACHINE\SOFTWARE\Altiris\eXpress\Notification Server\PausedNSMessaging
HKEY_LOCAL_MACHINE\SOFTWARE\Altiris\eXpress\Notification Server\EvtQueueFull

After making sure the services are started, cleaning the folder and confirming registry keys are fine, events should be processing. If not, please restart the services and check again. This should make NS functional (i.e. processing incoming events from Agents) but after the queue has become full it is necessary to monitor the queue folder to see if NS is able to sufficiently process the incoming events.

If the number of incoming events in the queue folder keeps increasing (note that this is OK temporarily as different policies do cause a lot of events to be posted in a short amount of time), the source and type of incoming events need to be analyzed and configuration modified to keep this from happening again. For this, please start with the following KB articles:

How to troubleshoot NSE processing issues (KB 205352)
How to check for excessive NSE files in the EventQueue and be alerted when too high (KB 232716)
Troubleshoot NSE Processing in 8.5 and later (KB 172741)
Evaluating NSE data using SQL when a deeper analysis is needed (KB 175763)