locked
Processing Backlogged Events Taking a Long Time RRS feed

  • Question

  • Hi,

    I'm getting the following repeated alerts in SCE. I have to stop the health monitor, clear the windows event logs and restart the health monitor. But then the problem appears again. The agent is running on a Windows 2008 R2 server running Termina Services. I have the management pack for Windows 2008 R2 and Terminla services imported into SCE.

    Alert: Processing Backlogged Events Taking a Long Time

    Source: SERVER

    Path: SERVER

    Last modified by: System

    Last modified time: 09/04/2010 16:00:22

    Alert description: The Windows Event Log Provider monitoring the System Event Log is 679802383 minutes behind in processing events.  This can occur when the provider is restarted after being offline for some time, or there are too many events to be handled by the workflow.

     

    Friday, April 9, 2010 3:05 PM

Answers

  • I will try this suggestion. I also found the following, sounds like a bug that will be fixed in a future update.

    http://support.microsoft.com/kb/974722

    Event ID 26017 from source "Health Service Modules" will be raised for Operations Manager 2007 SP1 agents, indicating "Event log Provider monitoring the <LogName> Event Log is # minutes behind," and the number of minutes is in the hundreds of millions.

    Problem: When an Operations Manager 2007 SP1 agent is installed on a computer that is running Windows 7 or Windows Server 2008 R2, the following event may be logged in one or more event logs. Additionally, value for the number of minutes is very large.

    Log Name: Operations Manager
    Source: Health Service Modules
    Event ID: 26017
    Level: Warning
    Description: The Windows Event Log Provider monitoring the %1 Event Log is %2 minutes behind in processing events. This can occur when the provider is restarted after it is offline for some time, or there are too many events to be handled by the workflow.

    Impact: None. These events are generated because of the delta between timestamps is calculated incorrectly. The event log processing is actually working correctly, and the events can be ignored.

    Workaround: No workaround is required. Ignore the events or upgrade to Operations Manager 2007 R2. This issue will be fixed in updates that will be available in the future for Operations Manager 2007 SP1.

    • Marked as answer by Yog Li Monday, April 19, 2010 2:43 AM
    Wednesday, April 14, 2010 3:03 PM

All replies

  • Hello Paulm,

    Try to flush the health service state and cache to see if it helps. To find the "Flush Health Service State and Cache" task, follow these steps.

    1. Run SCE console and navigate to Monitoring -> Computers.

    2. In the Computer section, locate the line for the related computer. If it is the SCE server, please double click its icon in the "Management Server" column. However, if it is not the SCE server, please double click its icon in the "Agent" column.  (Note: Please pay more attention to the location where you double click. If everything works, a new "State" dialog should open.)

    3. In the newly opened "State" dialog, right click the related computer’s item in the "Name" column, and then choose "Health Service Tasks". You will find the task of "Flush Health Service State and Cache" in the list.


    Yog Li - MSFT
    Wednesday, April 14, 2010 10:35 AM
  • I will try this suggestion. I also found the following, sounds like a bug that will be fixed in a future update.

    http://support.microsoft.com/kb/974722

    Event ID 26017 from source "Health Service Modules" will be raised for Operations Manager 2007 SP1 agents, indicating "Event log Provider monitoring the <LogName> Event Log is # minutes behind," and the number of minutes is in the hundreds of millions.

    Problem: When an Operations Manager 2007 SP1 agent is installed on a computer that is running Windows 7 or Windows Server 2008 R2, the following event may be logged in one or more event logs. Additionally, value for the number of minutes is very large.

    Log Name: Operations Manager
    Source: Health Service Modules
    Event ID: 26017
    Level: Warning
    Description: The Windows Event Log Provider monitoring the %1 Event Log is %2 minutes behind in processing events. This can occur when the provider is restarted after it is offline for some time, or there are too many events to be handled by the workflow.

    Impact: None. These events are generated because of the delta between timestamps is calculated incorrectly. The event log processing is actually working correctly, and the events can be ignored.

    Workaround: No workaround is required. Ignore the events or upgrade to Operations Manager 2007 R2. This issue will be fixed in updates that will be available in the future for Operations Manager 2007 SP1.

    • Marked as answer by Yog Li Monday, April 19, 2010 2:43 AM
    Wednesday, April 14, 2010 3:03 PM
  • Where's the SCOM 2007 SP1 update to fix this annoyance?  Win7 and Win2008 R2 have been out for over a year now!
    Friday, January 7, 2011 2:12 PM
  • Just like SCOM 2007 R2. Also been out for over a year
    Friday, March 4, 2011 10:03 AM
  • Hello Yog Li, How do you do this in SCE 2010? We have the same error coming back every day but we have problems following the steps you describe. (Maybe the steps were for SCE 2007 ?) Thank you for your help!
    Wednesday, April 13, 2011 11:17 AM