ntevl probe is missing events every day

Products

• DX Unified Infrastructure Management (Nimsoft / UIM)
• CA Unified Infrastructure Management On-Premise (Nimsoft / UIM)
• CA Unified Infrastructure Management SaaS (Nimsoft / UIM)

Issue/Introduction

The initial log attached displayed the following errors as well as some errors related to hung threads/thread exceptions:

Nov 28 12:16:55:059 [5292] ntevl: openMeteDataSavetoHash:EvtOpenPublisherMetadata failed 2
Nov 28 12:16:55:215 [5292] ntevl: openMeteDataSavetoHash:EvtOpenPublisherMetadata failed 1813
Nov 28 12:16:55:809 [5292] ntevl: openMeteDataSavetoHash:EvtOpenPublisherMetadata failed 13

Environment

• UIM 20.4 CU8
• ntevl 4.34

Cause

• Unsure but most likely, ntevl job/thread exhaustion

Resolution

ntevl: openMeteDataSavetoHash:EvtOpenPublisherMetadata failed 'n'

This is a remote session handle that the EvtOpenSession function returns. It gets the metadata for the provider on the local computer or returns NULL.

Event ID 7036 normally means that a service entered the start, stopped, or complete state so there could be numerous events that ntevl is trying to quickly process in a short time frame.

Recommended:

1. Upgrade robots  to version 9.40
2. Ensure ntevl v4.34 is in place on the given robots. Check versions using Tools->Find->probes, enter ntevl and click Ok.
3. Set 'Maximum Number of Threads' to 100 (minimum)
4. Set Alarm Timeout to an empty value

You can always test ntevl performance and try to reproduce an issue by using Microsoft eventcreate and send a bunch of back-to-back events simply by using the command history and pressing enter over and over and you can see the events update in the ntevl probe Status Tab.

It's very useful and it's easy to run tests using the eventcreate tool:

https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/eventcreate

No reoccurrences of missed events have occurred since making the changes noted above.