Redirecting the EventQueues have resulted in NSE's no longer being processed by the SMP
search cancel

Redirecting the EventQueues have resulted in NSE's no longer being processed by the SMP

book

Article ID: 156081

calendar_today

Updated On:

Products

IT Management Suite

Issue/Introduction

You have ability to redirect the EventQueue folder from the default location (C:\ProgramData\Symantec\SMP\EventQueue) to your desired location. There are a couple of potential concerns which are warnings about redirecting the EventQueues such as:

  1. Filling up the OS drive could cause the system to fail in unpredictable ways.
  2. The Logs and queues will have the propensity to fill a drive.
  3. The OS may be installed on mirrored drives which would significantly slow down write performance.
  4. The OS drive can be smaller than the other drives on the system.
  5. Internal policies may not allow any application information on C:\.

However, if EventQueue folder location is redirected to "\Program Files\Altiris\Notification Server\NSCap" directory where directory structure for the EventQueue folder already exists, then it will potentially stop processing of any NSE files by Notification server. In addition, there will be many errors recorded in the logs as a result of attempted NSE file processing by Notification server.

Source: MoveFile

Description: Failed to move file from 'S:\Program Files\Altiris\Notification Server\NSCap\EvtQueue\23a3c5db-6dba-47f8-a7cd-1412b2b0d51f.nse' to 'S:\Program Files\Altiris\Notification Server\NSCap\EvtQueue\Process\23a3c5db-6dba-47f8-a7cd-1412b2b0d51f.nse'. Exception details: System.IO.IOException: The process cannot access the file because it is being used by another process.
 
____________________________________________________________________________________________________________________
Source: Altiris.NS.EventRouter.DeliverFile
Description: EventRouter could not deliver the following file: 'S:\Program Files\Altiris\Notification Server\NSCap\EvtQueue\Process\279ac818-c775-495e-8c5a-7cab80ef63ba.nse'. Moving to 'S:\Program Files\Altiris\Notification Server\NSCap\EvtQueue\Bad\279ac818-c775-495e-8c5a-7cab80ef63ba.nse'...
 
( Exception Details: Altiris.NS.EventRouter+ServerBusyException: Queue was full.
 
____________________________________________________________________________________________________________________
Source: Altiris.NS.ClientMessaging.EventQueueDispatcher.PerformDispatch
Description: Failed to process event.
( Exception Details: System.IO.FileNotFoundException: Could not find file 'S:\Program Files\Altiris\Notification Server\NSCap\EvtQueue\782ced60-a50a-4068-8306-effcbd24af1c.nse'.
File name: 'S:\Program Files\Altiris\Notification Server\NSCap\EvtQueue\782ced60-a50a-4068-8306-effcbd24af1c.nse'
 
____________________________________________________________________________________________________________________
Source: Altiris.NS.StandardItems.Messaging.InventoryCaptureItem.OnMessage_Impl
Description: Failed to process NSE :
( Exception Details: System.IO.FileNotFoundException: Could not find file 'S:\Program Files\Altiris\Notification Server\NSCap\EvtQueue\7262b215-2e60-4a6b-8a6a-8c377c409697.nse'.
File name: 'S:\Program Files\Altiris\Notification Server\NSCap\EvtQueue\7262b215-2e60-4a6b-8a6a-8c377c409697.nse'

Environment

ITMS 8.x

Cause

NSE files are stopped being processed by SMP server because the EventQueues have been redirected to point to the NSCAP directory. The EventQueue located under NSCap directory structure is still being used by Symantec Management Platform for backwards compatibility with the old method of processing NSEs, as some solutions are yet to be updated to take an advantage of the changes made to EventQueue processing introduced in SMP 7.1 SP2. Redirection of EventQueues to NSCap directory structure results in a conflict between the new and old method of processing NSE files which results in unprocessed NSE files not being processed and moved to the bad folder.

The Receiver Service checks following two locations for any NSE files to be processed:

  • C:\ProgramData\Symantec\SMP\EventQueue\EvtInbox
  • InstallationPath + \NSCap\EvtInbox (and other eventqueues)

By redirecting the EventQueues to the NSCap directory, the two separate NSE processing methods are accessing the same data (new and old), and the outcome is unpredictable.

Resolution

As a best practice, it is advised that you should not redirect the EventQueues to the NSCap directory as this will result in NSE's not being processed, and it also causes issues affecting tasks such as Inventory and Active Directory Import.

If you have decided to redirect the EventQueues to different folder, you are required to consider following information carefully:

1) Do not redirect the EventQueues to a directory structure which has been created during the installation of the Symantec Management Platform (e.g. \Program Files\Altiris\)

2) Recommended: Modify the following registry to atleast 2048000 from default value 512000:

HKEY_LOCAL_MACHINE\Software\Altiris\eXpress\Notification Server\MaxFileQSize(KB)
MaxFileQSize(KB) is used to configure the maximum allowed size of a NSE event queue.

In Symantec Management Platform the processing method for NSE's has been changed under EventQueue folder. As a result, it is recommended to increase MaxFileQSize(KB) value to handle unexpected large quantity of NSE's coming in EventQueue folder to be processed. In addition, considering your environment setup, you might require to monitor the EventQueue folder to validate NSE's processing and make further adjustments to the key, if required.
 
3) Ensure you have sufficient space available in Hard disk drive where the redirected EventQueue folder resides.

4) Ensure that redirected EventQueue folder has following subfolders under directory structure:

EvtInbox
EvtQFast
EvtQLarge
EvtQPriority
EvtQSlow
EvtQueue
Temp

Powered by Wolken Software