none
Processing Backlogged Events Taking a Long Time

    Dotaz

  • I've a client got this error message: The Windows Event Log Provider monitoring the System Event Log is 371035 minutes behind in processing events. This can occur when the provider is restarted after being offline for some time, or there are too many events to be handled by the workflow. One or more workflows were affected by this. Workflow name: Microsoft.SystemCenter.Essentials.AUAgentUpdate.InventoryCycleRule Instance name: HK-PO.hknpl.com.hk Instance ID: {8FF0AC3C-3B0C-BD01-4C2E-FB3659ACEC6B} Management group: SCESVR_MG

    I tried to reinstall the agent but still failed.
    5. října 2009 2:05

Všechny reakce

  • Hi,
     
    When you reinstall the agent, do you also run the cleanup tool from the resource kit?
    When you have re-installed the agent, does the same event show up direct again?

    Anders Bengtsson | Microsoft MVP - Operations Manager | http://www.contoso.se
    6. října 2009 10:03
  • How can I run the cleanup tool? I do not have the resource kit. I have got the SCE setup cd only.
    The same event will show up after 1 or 2 days later. But only that client have this problem. It is a Windows Vista machine.
    Thanks.
    7. října 2009 4:28
  • Hi Clown,

    Please clear the Health Service Store cache on SCE Server.The default location is:C:\Program Files\System Center Essentials 2007\Health Service State\Health Service Store.Please cleanup the content in "Health Service Store" folder. (Please stop Opsmgr Health Service First).

    Also, Please try to clear the cache by running the SCE console from the command line with the option: /clearcache.

     

    Example:

    "C:\Program Files\System Center Essentials 2007\Microsoft.EnterpriseManagement.SCE.UI.Console.exe" /clearcache

    7. října 2009 11:27
    Moderátor
  • I was stopped the Opsmgr Health Service. Deleted the files in the "Health Service Store" folder, and run the command line you tauch.
    But it seems cannot solve the problem. Also the management status of monitoring is "Error". All of the Windows Computer Tasks could run successfully, but unable to connect the Event Viewer in Computer Management. It says network path was not found...
    Thanks for help.
    8. října 2009 5:41
  • Hi Clown,

    Did you create any custom rules?

    If you have for example configure a rule incorrect it can generate a local event on the agent machine very often and that can result in this event.
    12. října 2009 9:37
    Moderátor
  • No, I did not...
    and I don't know how to create...

    How to check if there have any customize rules??

    Thanks a lot.
    13. října 2009 1:53
  • I've a client got this error message: The Windows Event Log Provider monitoring the System Event Log is 371035 minutes behind in processing events. This can occur when the provider is restarted after being offline for some time, or there are too many events to be handled by the workflow. One or more workflows were affected by this. Workflow name: Microsoft.SystemCenter.Essentials.AUAgentUpdate.InventoryCycleRule Instance name: HK-PO.hknpl.com.hk Instance ID: {8FF0AC3C-3B0C-BD01-4C2E-FB3659ACEC6B} Management group: SCESVR_MG

    I tried to reinstall the agent but still failed.

    I have really the same problem. It only occurs, on Windows Server 2008 R2 and Windows 7 Clients. Any hint? Any help?
    3. listopadu 2009 7:46
  • I have the same problem with our Windows 7 clients. We are running mainly XP and 2003, with 2 Windows 7 machines.

    Alert Description:

    The Windows Event Log Provider monitoring the System Event Log is 679802382 minutes behind in processing
    events.  This can occur when the provider is restarted after being offline for some time, or there
    are too many events to be handled by the workflow.

    One or more workflows were affected by this.

    Workflow name: Microsoft.Windows.Client.Win7.Computer.RADAR_Error.Monitor

    Instance name: ukw00952.***.com

    Instance ID: {B9483A25-6CA0-7D30-1AD6-F676B0E1F970}

    Management group: UK-ABI-SIT01_MG

    Anyone have any idea?
    30. listopadu 2009 17:26
  • Hi!

    The problem regarding backlogged events can safely be ignored as per: http://support.microsoft.com/kb/974722

    Event ID 26017 from source "Health Service Modules" will be raised for Operations Manager 2007 SP1 agents, indicating "Event log Provider monitoring the <LogName> Event Log is # minutes behind," and the number of minutes is in the hundreds of millions.
    Problem: When an Operations Manager 2007 SP1 agent is installed on a computer that is running Windows 7 or Windows Server 2008 R2, the following event may be logged in one or more event logs. Additionally, value for the number of minutes is very large.

    Log Name: Operations Manager
    Source: Health Service Modules
    Event ID: 26017
    Level: Warning
    Description: The Windows Event Log Provider monitoring the %1 Event Log is %2 minutes behind in processing events. This can occur when the provider is restarted after it is offline for some time, or there are too many events to be handled by the workflow.

    Impact: None. These events are generated because of the delta between timestamps is calculated incorrectly. The event log processing is actually working correctly, and the events can be ignored.

    Workaround: No workaround is required. Ignore the events or upgrade to Operations Manager 2007 R2. This issue will be fixed in updates that will be available in the future for Operations Manager 2007 SP1.



    Best regards,

    Michael Pultz-Hansen
    • Navržen jako odpověď michael074 21. prosince 2009 12:26
    21. prosince 2009 12:26
  • Where's the SCOM 2007 SP1 update to fix this annoyance?  Win7 and Win2008 R2 have been out for over a year now!
    • Navržen jako odpověď Glennacook 24. února 2012 17:32
    • Zrušeno navržení jako odpověď Glennacook 24. února 2012 17:32
    7. ledna 2011 14:10
  • What I've done and has worked for me is to uninstall and reinstall the client software then reboot the computer. Remove the client for the domain (join a workgroup) and then rejoin the domain.
    24. února 2012 17:35