How to check for excessive NSE files in the EventQueue and be alerted when too high

Products

• IT Management Suite

Issue/Introduction

By default, the SMP server will allow a maximum of 20,000 NSE files into the EventQueue folder (C:\ProgramData\Symantec\SMP\EventQueue\EvtQueue).  This is configurable using the registry key:  HKEY_LOCAL_MACHINE\SOFTWARE\Altiris\eXpress\Notification Server DWord:  MaxFileQEventCount.  Once the SMP server reaches 20,000 files, it starts telling endpoints to queue their NSE files locally.  If the SMP server is unable to catch up, this can cause a performance impact on the SMP server in addition to causing a flood of NSEs into the SMP after the issue is resolved.  For further help troubleshooting backed-up NSEs, please reference How to Troubleshoot NSE processing issues

You may wish to implement this custom PowerShell script, scheduling it to run through Windows Task Scheduler or a script task on the SMP.  This custom PowerShell script will check the total file count in the EvtQueue folder and will send an email alert when it gets too high.  You may consider setting this to something around 10,000 or 15,000 files.  The script uses 5,000 to start.

Environment

ITMS 8.x

Cause

N/A

Resolution

Start off by saving the following PowerShell script into Notepad and saving the file to something of your choosing with a .PS1 extension.

<#
.SYNOPSIS
Gets the total amount of files in the EvtQueue folder
.DESCRIPTION
This script will get the total count of files in the EvtQueue directory.  It will then use an if statement to check
if the total count of files is above what you specify.  If the count is at least what you have specified, it will utilize the send-mailmessage cmdlet.
.EXAMPLE
This script would be best copy and pasted into a server script task.  You can schedule it to execute on a regular basis.  Or, you could use Windows
Task Scheduler to simply execute the script on the desired frequency.
#>

<#
-To will be the recipient address.
-From is the person sending the e-mail
-Subject this can be anything you want
-Body this can be anything you want
-SmtpServer is your SmtpServer's name.  This is required
-There is a ` backtick at the end of each line.  Please do not delete this.
#>

#Gets information on the directory specified
$nsecount = Get-ChildItem C:\ProgramData\Symantec\SMP\EventQueue\EvtQueue

#Takes the variable nsecount and counts the amount of files.  If above the number specified, sends an e-mail.

if ($nsecount.Count -gt "5000"){
Send-MailMessage -To "Altirisadmin <[email protected]>" -From "Postmaster <[email protected]>"`
-Subject "High NSE Count" -Body "The folder located at C:\ProgramData\Symantec\SMP\EventQueue\EvtQueue has a large amount of files.  Please check the server."`
-SmtpServer localhost -Priority High
}

Once you have the script saved, you need to modify the lines specified in the script comment section.  You can run it directly from the SMP, using a script task.  Another option is to use Windows Task Scheduler to execute the script.