How to Capture NSEs on a Windows client
search cancel

How to Capture NSEs on a Windows client


Article ID: 180102


Updated On:


IT Management Suite


For troubleshooting purposes, it can be useful to trap a copy of each outgoing NSE file that the Symantec Management Agent for Windows sends to the Notification Server.


A good resource when troubleshooting client-side issues involving NSEs is the option to capture NSEs as they are sent to the server.

Capture NSEs on the client by:

  1. Open Registry Editor
  2. Navigate to HKEY_LOCAL_MACHINE\Software\Altiris\Altiris Agent\Transport
  3. Modify the String value "Capture Events Folder" so that the Value data points to a directory or path, for example, "C:\Temp".
  4. Perform the actions to troubleshoot, such as Collecting Inventory, Installing Software, or performing a Patch Management scan (run "AeXPatchUtil.exe /i" as outlined in KB 181828.)

Analyze what NSEs are being sent from this client machine. To test if the NS is processing them, copy the captured NSEs to C:\ProgramData\Symantec\SMP\EventQueue\EvtInbox.

Be sure to remove the value from this registry entry after testing as it will eventually consume significant disk space.


The Reg Key is included as a Task in the Altiris Diagnostic Tasks KB: KB 181029.  Easily enable and disable this Reg Key using Tasks.