Capturing NSEs on a Windows client

Products

• IT Management Suite

Issue/Introduction

For troubleshooting purposes, it can be useful to trap a copy of each outgoing NSE file that the Symantec Management Agent for Windows sends to the Notification Server.

Environment

ITMS 8.x

Resolution

A good resource when troubleshooting client-side issues involving NSEs is the option to capture NSEs as they are sent to the server.

Capture NSEs on the client by:

1. Open Registry Editor
2. Navigate to HKEY_LOCAL_MACHINE\Software\Altiris\Altiris Agent\Transport
3. Modify the String value "Capture Events Folder" so that the Value data points to a directory or path, for example, "C:\Temp".
4. Perform the actions to troubleshoot, such as Collecting Inventory, Installing Software, or performing a Patch Management scan (run "AeXPatchUtil.exe /i" as outlined in KB 181828.)

Analyze what NSEs are being sent from this client machine. To test if the NS is processing them, copy the captured NSEs to C:\ProgramData\Symantec\SMP\EventQueue\EvtInbox.

Be sure to remove the value from this registry entry after testing as it will eventually consume significant disk space.

The Reg Key is included as a Task in the Altiris Diagnostic Tasks KB: KB 181029. Easily enable and disable this Reg Key using Tasks.

Additional Information

updated link to external access to KB181828. Was linked through wolken