We've had some issues recently in which we've discovered that no events have been collected for a period of several days, but the manager is up and running as far as we can tell. The issue appears to have been resolved by upgrading to v6.3, however it's raised the following questions regarding how the agents on our Windows servers process collected events. Will the agent cache events if it cannot connect to the manager and, if so, what parameters are available for controlling the number of events that are cached and/or the time period that these are retained for? Is there a specific Internal event that would indicate that the agent is seeing the manager as online and available and is therefore sending its collected events, but they are never being written to the database? (This is what I suspect was happening in our specific situation.) Thanks for the help.

This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.

You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Agent Event Caching and Delivery to Manager

afiore over 7 years ago

We've had some issues recently in which we've discovered that no events have been collected for a period of several days, but the manager is up and running as far as we can tell. The issue appears to have been resolved by upgrading to v6.3, however it's raised the following questions regarding how the agents on our Windows servers process collected events.

Will the agent cache events if it cannot connect to the manager and, if so, what parameters are available for controlling the number of events that are cached and/or the time period that these are retained for?
Is there a specific Internal event that would indicate that the agent is seeing the manager as online and available and is therefore sending its collected events, but they are never being written to the database? (This is what I suspect was happening in our specific situation.)

Thanks for the help.

0 jhynds over 7 years ago

Hi afiore,
curtisi provided some information in this thread that may be helpful: Agent Cache Size
I'm not aware of any specific internal events to capture the scenario mentioned in point #2, but I would certainly recommend keeping an eye on Internal Alert/Error/Exception/Warning if/when this happens again. If it happens again I would also recommend raising a technical support ticket & they could capture & analyse manager/agent debug logs which may provide some clues also.
Cancel
Vote Up 0 Vote Down

Cancel