UIM - NTEVL Error - The restart of the probe openMeteDataSavetoHash:EvtOpenPublisherMetadata failed 2

Products

• DX Unified Infrastructure Management (Nimsoft / UIM)

Issue/Introduction

This is a technical article documenting a known probe error message written to the probe logs on start up: 

openMeteDataSavetoHash:EvtOpenPublisherMetadata failed 2 

Environment

Release : 20.3

Component : UIM - NTEVL

Resolution

Information from ntevl engineering: 

This is not an issue or defect, this is an error message the probe is printing which is returned by Windows API. While collecting the meta information of the Event logs if that Event doesn't exist, the Windows API returns an error (openMeteDataSavetoHash:EvtOpenPublisherMetadata failed 2).

Scenario where windows API returns Error: 

When performing a probe restart, the probe calls the windows API to get the list of all the Events logs.

For all these Events logs, the probe collects meta-information one by one by calling the Windows API and storing it for future use.

In a few cases, Events logs got generated by windows and API returns the Event logs, when probes call another win API to get meta of that Event logs in the meantime that Event got removed by windows in that case windows API will return an error and the same error we are printing in a log message.