Question: What are those .ok, .blocked, .disabled extension files that looks like a NSE? For example:
SMA agent creates those files in NSE capture folder on the agent side. These files can be found only in the capture folder.
.ok – means event was sent OK
.blocked – means event wasn’t sent because the agent is not registered
.disabled – means that NSE are disabled on the agent side
The suffix could be PSE and NSE, where
NSE – event was sent to the server directly
PSE – event was queued to the event queue on the agent
Also the numbers you see in the file names are priority, agent instance ID and event ID, the last one shows the order of NSEs.
Question: So can we assume that those files can be copied and placed in the evtIbox folder, the queue process will know what to do with them and process them?
No. These files are named this way only in the agent’s capture folder. This is purely for troubleshooting purposes, so we could find out which events were sent, which were not, in which order, which event was posted, which was sent directly.