Submitting forms on the support site are temporary unavailable for schedule maintenance. If you need immediate assistance please contact technical support. We apologize for the inconvenience.
Delayed/Lost Log Retrieval in the InTrust Deployment Manager
Description
Agents deployed to Domain Controllers and some member servers seem to get stuck or have a long delay in the last collection date stamp in the InTrust Deployment Manager. In the InTrust Manager, the agents appear to be connected and healthy and processing policies and alerts.
Checking the Repository viewer shows that the last date that the events are collected matches the dates listed in the Deployment Manager
Cause
Sometimes an agent can "Lose its place" in a real-time collection if the log that it was collecting has "rolled over" since the last collection.
Resolution
To correct this behavior, please do the following:
Stop the InTrust services on all InTrust Servers
Take a full backup of the InTrust_cfg_db
Open up SQL Server Management Studio and perform the following query:
UPDATE [InTrust_Cfg_DB].[dbo].[ITRTProcessingRule] SET [LimitEventsCount] = 10 WHERE [LimitEventsCount] > 10
(You may need to customize the "Intrust_cfg_db" name if you have used a custom database name in your deployment)
Start the InTrust services on all InTrust Servers
Uninstall and re-install the agents on all hosts affected by this issue
On affected the agent hosts:
Increase the size of the windows logs that are rolling over too quickly, try doubling or tripling their current size.
Your Request will be reviewed by our technical reviewer team and, if approved, will be added as a Topic in our Knowledgebase.
Recommended Content
Product(s):
InTrust
11.6, 11.5.1, 11.5, 11.4.2
Topic(s):
Troubleshooting
Article History:
Created on: 11/19/2019 Last Update on: 3/6/2024
Thank you for your feedback for Topic Request
Your Request will be reviewed by our technical reviewer team and, if approved, will be added as a Topic in our Knowledgebase.
Welcome to Quest Support
You can find online support help for Quest *product* on an affiliate support site. Click continue to be directed to the correct support content and assistance for *product*.
The Quest Software Portal no longer supports IE8, 9, & 10 and it is recommended to upgrade your browser to the latest version of Internet Explorer or Chrome.