ntevl probe is generating duplicate or historical alarms for past Event Viewer entries

Products

• DX Unified Infrastructure Management (Nimsoft / UIM)
• CA Unified Infrastructure Management On-Premise (Nimsoft / UIM)
• CA Unified Infrastructure Management SaaS (Nimsoft / UIM)

Issue/Introduction

Several ntevl probe instances are incorrectly processing historical Windows Event Viewer logs, resulting in duplicate alarms for past events. This behavior typically occurs after a probe restart, a server reboot, or when the probe fails to track its current read position (checkpoint) in the event logs.

Environment

ntevl probe through version 4.35

Resolution

1. Access the UIM Archive and locate the ntevl probe (version 4.36).

2. Download the package to your local archive.

3. Deploy the probe to the designated target robots.

 

Additional Information

ntevl (NT Event Log Monitoring) Release Notes