FlushAgentEvents – Flush NSEs in Agent's Queue
search cancel

FlushAgentEvents – Flush NSEs in Agent's Queue

book

Article ID: 179877

calendar_today

Updated On:

Products

IT Management Suite Client Management Suite

Issue/Introduction

When the Notification Server (also known as SMP Server) queues have reached the maximum number of NSEs and the Altiris Agent is directed to back off, the agent will queue its NSE to send at a later time. Over a period of time, it is possible that many agents will have queued NSEs, in the C:\Program Files\Altiris\Altiris Agent\Queue folder, that could overwhelm the Notification Server. It may be useful to disregard all incoming NSEs and also to direct the Altiris Agents to flush their local queues.

The SMP Logs can show the following:

Unable to process client request from: <IP Address>/HEAD/8.6.2184.0 (Unable to process request, 0x80056007)

Environment

ITMS 8.x

Resolution

Step 1: If Time Critical Management > Persistent Connections are enabled, disable them in Notification Server:

Step 2: Enable FlushAgentEvents

NOTE: FlushAgentEvents is also configurable in Core Settings.  Beginning in ITMS 8.5 you can view the Core Settings in the Console: Settings > Notification Server > Core Settings.

The registry key FlushAgentEvents (Reg_Dword located under HKEY_LOCAL_MACHINE > SOFTWARE > Altiris > eXpress > Notification Server) controls the ability to flush the local queue for the Altiris Agent. When set to 1, the Notification Server's Event Router will send the Altiris Agent an error response that will activate "flush local queues" on the Altiris Agent side. By default, this value is 0.

NOTE: This registry setting exits only on the Notification Server.

If the FlushAgentEvents registry key does not exist on your Notification Server, you can create it. In REGEDIT, click My Computer > HKEY_LOCAL_MACHINE  >  SOFTWARE > Altiris > eXpress. Right-click Notification Server, click New, click DWORD Value, type FlushAgentEvents, and press Enter. Change the value to 1 to stop the Altiris Agents from reporting in. Change it back to 0 to have the Altiris Agents report in. 

OR

REM Value of 0 Allows Agents to report it.
reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Altiris\eXpress\Notification Server" /v "FlushAgentEvents" /t REG_DWORD /d 0 /f 

Step 3: for the fastest denial, restart the AeXSVC

Step 4: Validate that agents are being rejected by sending Basic Inventory from an (SMP) Agent UI:



Note:
In the Agent logs you should see a log entry like these ones:

Failed to send basic inventory, COM error: The server is currently busy, the pending agent events should be flushed (0x80056007)
-----------------------------------------------------------------------------------------------------
Date: 11/8/2023 11:40:28 AM, Tick Count: 11592328 (03:13:12.3280000), Size: 356 B
Process: AeXNSAgent.exe (6536), Thread ID: 10676, Module: AeXNSAgent.exe
Priority: 1, Source: ConfigServer

Operation 'Direct: Head' failed. 
Url: HTTPS://<SMPServer.yourdomain.com>:443/altiris/NS/Agent/PostEvent.asp?encrypted=1&priority=1&source=0181849A-8403-4D77-BBDC-251D1C75983A 
Connection path: 1* - Direct: [172.16.13.153] -> <SMPServer.yourdomain.com> [172.16.16.135:443] 
Connection id: 80.6536 
Communication profile id: {xxxxxxxx-7a71-4222-98d8-6f97d5b9b96b} 
Throttling: 0 0 0 
Connecton stage: Server connect 
Error type: SMP Server error 
Error code: The server is currently busy, the pending agent events should be flushed (0x80056007) 
Error note: HTTP Status 200: 200 OK 
Server SSL connection info: 
   Server certificate: 
      Serial number: xx xx xx xx xx 47 4d 10 c3 e2 5d c6 3a d4 28 9f 
      Thumbprint: xx xx xx xx xx ca c8 24 fb f1 93 3a 44 d6 99 38 e2 e9 0d 6d 
   Client certificate: 
      Serial number: N/A 
      Thumbprint: N/A 
   Cryptographic protocol: TLS 1.2 
   Cipher suite: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 
   Cipher algorithm: AES 
   Cipher key length: 256 
   Hash algorithm:  
   Hash length: 0 
   Key exchange algorithm: ECDH 
   Key length: 384 
Client SSL attributes for server connection: 
   Client certificate: 
      Serial number: N/A 
      Thumbprint: N/A 
   Cryptographic protocol: TLS 1.0, 1.1, 1.2
-----------------------------------------------------------------------------------------------------
Date: 11/8/2023 11:40:28 AM, Tick Count: 11592312 (03:13:12.3120000), Size: 1.48 KB
Process: AeXNSAgent.exe (6536), Thread ID: 10676, Module: AeXNetComms.dll
Priority: 1, Source: NetworkOperation

Step 5: Set this setting back to "0" after 24-48 hours.

Additional Information

175204 Clear queued events on endpoints in Symantec Management Platform 8.5

279737 There is a slowness processing NSEs