0 Replies Latest reply on May 30, 2017 7:42 AM by mortenklow

    Windows server reboot events get logged multiple times in incorrect order

    mortenklow

      Hi,

       

      We have a wierd issue with NPM that sometimes occur when a Windows server reboots.

       

      What happens is that the node in NPM gets a log event saying "<NAME> rebooted at <DATE> <TIME>", with the correct date and time.

      Then, right after that, it gets a new identical event, only with the date an time from the last time the server rebooted.

      Additionally the field "Last boot" gets updated with the last reboot event, and the last event is the one with incorrect date and time, from the last time the server rebooted.

       

      That makes it really hard to get a good picture of when a server rebooted, without looking through the events.

       

      Here is an example from one of the Windows server nodes:

      It logged an additional wrong event when it got rebooted 20/04/2017 and 13/05/2017.

      But for the two reboots that happened 26/04/2017, it only logged the correct event for each reboot.

       

      As it sits right now, the last logged reboot event is from 13/05/2017, but with the message that says 26.04.2017. Therefor the "Last boot" field is now wrong:

       

       

      We run Orion platform 2017.1.1 SP1 with NPM 12.1 and NTA 4.2.2

      Running four additional pollers in addition to our main poller.

      We are polling all our Windows server with the ICMP+SNMP option.

       

      Any suggestions on why NPM is doing this, and how to resolve it?

       

       

      Thanks in advance!

       

      Best regards,

      Morten