ntevl Error Job queue exhausted as Incoming events are more.. Increase number of threads to process events fast.

Products

• DX Unified Infrastructure Management (Nimsoft / UIM)
• CA Unified Infrastructure Management On-Premise (Nimsoft / UIM)
• CA Unified Infrastructure Management SaaS (Nimsoft / UIM)

Issue/Introduction

Ntevl  probe getting the below error while monitoring windows NT event. Because of this issue we are missing windows event error

 

Apr  2 06:40:36:390 [12216] ntevl: evlStoreEventsInQueue(): Job queue exhausted as Incoming events are more.. Increase number of threads to process events fast.. 

Apr  2 06:40:36:406 [12216] ntevl: evlStoreEventsInQueue(): Job queue exhausted as Incoming events are more.. Increase number of threads to process events fast.. 

Apr  2 06:40:36:412 [12216] ntevl: evlStoreEventsInQueue(): Job queue exhausted as Incoming events are more.. Increase number of threads to process events fast.. 

 

Environment

• Release : All supported UIM versions
• Component : UIM - NTEVL

Cause

This occurs when the rate of incoming Windows events exceeds the probe's ability to process them. This can be caused by:

1. Insufficient thread count.
2. Queue size limit reached.
3. High volume of specific Event IDs (e.g., Security logs on Domain Controllers).
4. Insufficient CPU/RAM on the host server.

Resolution

Fine tune the NTEVL probe by increasing the poll rate to 60 seconds or more to give the probe enough time to process the collected data and the thread count to 10 or more to process the data faster.

Note that the issue can be caused by a high volume of incoming EvenIDs (e.g. malfunctioning service restarting in loop on the machine) - a potential workaround includes excluding such an event from the monitoring in probe's configuration.

 

Additional Information

You may also want to increase max_job_queue_size parameter. Refer to the following article:

Ntevl probe log shows "Waiting.. current job Queue count..30000 reached 'max_job_queue_size' limit 30000"