Capturing NSEs on a Windows client

Products

• IT Management Suite

Issue/Introduction

For troubleshooting purposes, it can be useful to trap a copy of each outgoing NSE file that the Symantec Management Agent for Windows sends to the Notification Server.

Environment

ITMS 8.x

Resolution

A good resource when troubleshooting client-side issues involving NSEs is the option to capture NSEs as they are sent to the server.

Capture NSEs on the client by:

1. Open Registry Editor
2. Navigate to HKEY_LOCAL_MACHINE\Software\Altiris\Altiris Agent\Transport
3. Modify the String value "Capture Events Folder" so that the Value data points to a directory or path, for example, "C:\Temp".
4. Perform the actions to troubleshoot, such as Collecting Inventory, Installing Software, or performing a Patch Management scan (run "AeXPatchUtil.exe /i" as outlined in KB article AexPatchUtil.exe command line options and examples.)

Analyze what NSEs are being sent from this client machine. To test if the NS is processing them, copy the captured NSEs to C:\ProgramData\Symantec\SMP\EventQueue\EvtInbox.

Be sure to remove the value from this registry entry after testing as it will eventually consume significant disk space.

The Reg Key is included as a Task in the Altiris Diagnostic Tasks KB. Easily enable and disable this Reg Key using Tasks.

Additional Information

Capture processed NSEs on the Notification Server for analysis

How to gather Inventory NSEs from clients