audit table is full of unneeded records from the ntevl probe

Products

• DX Unified Infrastructure Management (Nimsoft / UIM)

Issue/Introduction

The audit table (audit_event) table is full of unneeded records from the ntevl probe.

Audit records like:

Jul  7 07:35:21:994 [15356] 1 audit: [22183520] hub=<example_hub> robot=<example_robot> probe=ntevl config_change=yes 
Jul  7 07:35:21:995 [15356] 2 audit: [22183520] change: section=/setup                         key=system_pos            584986    ->584987 

This is coming every poll cycle from every robot with ntevl installed.

 

Can we limit these messages being written to the database? 

Environment

• DX UIM 23.4.*
• ntevlel 4.35

Cause

In ntevl 4.35 and earlier the latest event IDs (for example application, system, security) are updated in the ntevl.cfg file during each polling interval or whenever a new event is generated. This behavior causes every update to be recorded in the audit logs, resulting in large audit records for the NTEVL probe.

Resolution

ntevl 4.36 GA will include this fix - As of Dec. 2025, is not release yet. 

A patch version exists if needed, open a support case. With this build the event IDs are now updated in the ntevl.pos file instead. This change prevents frequent audit logging, significantly reducing the size of audit records.