Due to the changes to how NSEs are processed introduced in ITMS 7.1 SP2, the "bad" NSE files are no longer captured and stored on the Notification Server.
The Notification Server attempts to process each "bad" NSE three times, creating a Log entry for each attempt, then deletes it.
It is sometimes beneficial to review these failed NSE files when trying to diagnose the reason for the failure, especially if getting a larger number of them.
Please Note: Back up your registry before any changes are made.
To enable the capture of these NSE files the Registry String Value "EventFailureBackupFolder" needs to be added to "HKEY_LOCAL_MACHINE\SOFTWARE\Altiris\eXpress\Notification Server". The string value should be the folder you want the "bad" NSE to be stored in.
Starting with ITMS 8.5 release, you can change this core setting in the Symantec Management Console. Open Settings>Notification Server>Core Settings> and filter for "EventFailureBackupFolder" for example and add the path where you want to save these NSEs.
The change may take a few minutes to be applied. To apply the changes faster, restart the Altris Service.
It is also possible to capture all NSE files by creating a similar Registry String Value called "EventCopyFolder" under "HKEY_LOCAL_MACHINE\SOFTWARE\Altiris\eXpress\Notification Server" or use the Core Setting page mentioned above.
NOTE: A new report was also added at this time to provide more useful Event Queue information. The report is located under Reports>Notification Server Management>Server>Event Queue Statistics.