none
Processing Backlogged Events Taking a Long Time - On SCOM 2007 R2 RRS feed

  • Question

  • Hello,

     

    We started getting a few of these alerts the other day on two of our Windows 2008 R2 Servers.  I found the below KB article saying these alerts can be ignored or upgrade to Operations Manager 2007 R2.  However, we are running OpsMgr 2007 R2. Is anyone else still experiencing this with R2?

     

    http://support.microsoft.com/kb/974722

     

     

    Log Name:      Operations Manager

    Source:        Health Service Modules

    Date:          9/14/2010 1:55:24 AM

    Event ID:      26017

    Task Category: None

    Level:         Warning

    Keywords:      Classic

    User:          N/A

    Computer:      XXXX

    Description:

    The Windows Event Log Provider monitoring the System Event Log is 11 minutes behind in processing events.  This can occur when the provider is restarted after being offline for some time, or there are too many events to be handled by the workflow.

     

    One or more workflows were affected by this. 

     

    Workflow name: many

    Instance name: many

    Instance ID: many

    Management group: xxx

    Thanks,

    Tom

     


    Tom Martin Email: tmartin@caa.com
    Thursday, September 16, 2010 6:07 PM

Answers

All replies

  • Hi,

     

    Please check the following:

     

    1.    On the RMS and the SQL Server, please check if the usage of CPU or memory will be high when the issue occurs

     

    2.    The communication between the RMS and the SQL Server is OK.

     

    3.    If there are any other related errors on the RMS and the SQL Server, please also let us know in detail.

     

    Thanks.


    Nicholas Li - MSFT
    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    • Marked as answer by martit01 Friday, September 17, 2010 10:47 PM
    • Unmarked as answer by martit01 Friday, September 17, 2010 10:47 PM
    Friday, September 17, 2010 7:50 AM
    Moderator
  • Thanks Nicholas,

    1. I ran performance reports on both the RMS and SQL Server and saw no spikes in performance.
    2. Communication between the RMS and SQL Server is good.  I'm assuming if this was an issue we would have seen other alerts beside this one.
    3. There were no other alerts occurring on the RMS and SQL Server at the time of this alert.

    I also checked one of the servers which generated this alert and saw no unusual high number of events in the Operations Manager event log during the time of this alert.

    Thanks,

    Tom

     


    Tom Martin Email: tmartin@caa.com
    Friday, September 17, 2010 10:57 PM
  • Hi Tom,

    R u running OpsMgr on hardware or a virtual machine (particularly your SQL)?

    If VM, then I wouldn't be surprised. 

    If hardware...what are the specs of the box(es) and how many servers are u monitoring?

    And maybe have a look at the following:

    http://blogs.technet.com/b/kevinholman/archive/2009/11/25/tuning-tip-turning-off-some-over-collection-of-events.aspx

    http://blogs.technet.com/b/kevinholman/archive/2009/12/21/tuning-tip-do-you-have-monitors-constantly-flip-flopping.aspx

     

    Cheers,

    John Bradshaw


    • Marked as answer by martit01 Wednesday, September 22, 2010 5:51 PM
    Monday, September 20, 2010 9:45 AM
  • Yes, we are running a VM environment including the SQL backend.

    Thanks for the links to Kevin's blog, I will start doing some tuning.

    -Tom


    Tom Martin Email: tmartin@caa.com
    Wednesday, September 22, 2010 5:51 PM