-
Title
Foglight Agent Manager (FglAM) reported high usage of cpu and memory -
Description
Sudden increase of CPU and memory used by Foglight Agent Manager (FglAM).
Continuously seeing repeated warning errors in FglAM log. Following are examples:
ECHO WARN [Quartz[0]-0] com.quest.glue.core.remoteconnection.WMIUtils - The remote system has indicated that the query "SELECT * FROM Win32_NTLogEvent WHERE TimeGenerated >= '20160714200329.468000+540' AND Logfile='Application'" has failed, no results will be returned.com.quest.glue.api.services.QueryFailedException: The query 'SELECT * FROM Win32_NTLogEvent WHERE TimeGenerated >= '20160714200329.468000+540' AND Logfile='Application'' has failed (0x80041001)at com.quest.glue.core.remoteconnection.WMIUtils.createQueryFailedException(WMIUtils.java:382)at java.lang.Thread.run(Thread.java:662)Caused by: com.jacob.com.ComFailException: Invoke of: CountSource: SWbemObjectSetDescription: 일반 오류입니다.at com.jacob.com.Dispatch.invokev(Native Method)at com.jacob.com.Dispatch.invokev(Dispatch.java:625)at com.jacob.com.Dispatch.get(Dispatch.java:788)at com.quest.glue.core.remoteconnection.WMINativeConnectionImpl.validateDispatch(WMINativeConnectionImpl.java:392)at com.quest.glue.core.remoteconnection.WMINativeConnectionImpl.executeQueryInternal(WMINativeConnectionImpl.java:316)... 34 more -
Cause
A corrupted application log has been identified in the latest FglAM startup log.
ECHO WARN [Quartz[0]-0] com.quest.remoteos.collectors.windows.WindowsKBDiagnosticUtil - The Application log file for <hostname> may or may not be corrupted. Please open the log via the Windows Event Viewer and if it is corrupted a dialog stating so will become visible. If corrupted, follow the steps at http://technet.microsoft.com/en-us/library/bb457024.aspx to repair the log, and install the Microsoft Hotfix #975652 at http://support.microsoft.com/kb/975652 if the platform is Windows Server 2003.
It is possible agent was repeatedly retrying reading a corrupted event log causing the cpu/memory spike.
-
Resolution
1) Install the Microsoft Hotfix #975652 at http://support.microsoft.com/kb/975652 if the platform is Windows Server 2003.
or
2) Disable Event log collection. Change the Agent properties and set Collect log events = false in the IC-Agent