-
タイトル
New events are not appearing in Change Auditor -
説明
No new events are appearing in Change Auditor, even after deliberate actions are taken that would normally trigger an event.
The following error may be seen in the ChangeAuditor.Service.exe.nptlog file:
"Too many events in Scheduler task queue: 1003 (maximum: 1000), cannot accept more"
-
原因
There are many possible causes for this behavior. It is possible that too many events are coming in at once, and the Coordinator is becoming overloaded, or the SQL Server is unable to keep up with the load. -
対策
Workaround 1:
Confirm that the Change Auditor database hasn't reached the maximum size, or that the disk it resides on hasn't run out of space.
Workaround 2:
If any recent changes were made to enable new auditing functionality, or if a new server was added for auditing, it is possible that it is contributing far more events than were expected. Generally this happens with Change Auditor for Windows File Servers, Change Auditor for Netapp, Change Auditor for EMC, Change Auditor for Exchange, or Change Auditor for AD Queries.
If so, disable that new auditing, and allow the Coordinator to work through the backlog. Re-evaluate the auditing configuration, and turn off the more chatty events. After the Coordinator has worked through the backlog, the Agent Statistics page can be useful in identifying abnormal trends in the type of events that came through.
You can determine which events have the largest number of items in the database:
- Start the CA Client
- Select the Overviews tab
- In the bottom left of the window you should see Top Agent Activity (this is the default filter). Click the blue filter icon to the left of the Top Agent Activity bar
- Select Count of Events By | Event Class
Workaround 3:
Increase the SQL Timeout values using the steps in the following KB:
https://support.quest.com/change-auditor/kb/128042/-too-many-events-in-scheduler-task-queue-128042-
If the issue persists, please monitor the SQL server as a possible bottleneck.