Processing Backlogged Events Taking a Long Time

Patrick

unread,

Jan 20, 2009, 9:32:10 AM1/20/09

to

Hi there!

I received this alert from one of my agents:
Processing Backlogged Events Taking a Long Time
The Windows Event Log Provider monitoring the System Event Log is 15 minutes
behind in processing events. This can occur when the provider is restarted
after being offline for some time, or there are too many events to be handled
by the workflow. One or more workflows were affected by this. Workflow name:
many Instance name: many Instance ID: many Management group:

Has anyone an idea concerning this issue?

Many thanks in advance,
Patrick

Anders Bengtsson [MVP]

unread,

Jan 20, 2009, 4:28:24 PM1/20/09

to

Hello Patrick,

Stefan has a intresting post about that at http://64.233.183.104/search?q=cache:Z9KUZgEHcV0J:www.weblog.stranger.nl/operations_management/scom_2007+Ops+Mgr+ACS+agent+queue&hl=sv&ct=clnk&cd=4&gl=se

Tarek also have a intresting one about tuning the ACS queue http://tarek-online.blogspot.com/2007/05/configuring-audit-collection-services.html

Have you created any custom rules? If you have for example configure a rule
incorrect it can generate a local event on the agent machine very often and
that can result in this event.

Anders Bengtsson
Microsoft MVP - System Center Operations Manager
www.contoso.se

Patrick

unread,

Jan 22, 2009, 3:00:01 AM1/22/09

to

Anders,

at the moment I don't have ACS configured on any server.

Yes, I have a few custom rules but I don't think that this could be the
problem because I received this event just from one of about 500 agents.

Any other idea?

Thanks,
Patrick

Derv

unread,

Apr 13, 2009, 3:08:18 PM4/13/09

to

I am only receiving these alerts from one server out of 400. It is one of
three servers that we are monitoring that is running Windows 2008.

Gorazd Semrov

unread,

Jun 1, 2009, 3:30:01 PM6/1/09

to

Patrick

I had same issues with one of my servers. Issuee was caused by wrong time at
some moment on particular server. Solution is by clearing event logs on that
server.

regards
Gorazd Šemrov

Derv

unread,

Jun 2, 2009, 11:15:01 AM6/2/09

to

Patrick,

I tried clearing the event log, but didn't make any difference. The alert
cleared, but then came right back in a few minutes. We have a case open with
Microsoft. Thanks for the suggestion.

bubslg

unread,

Jun 2, 2009, 4:26:41 PM6/2/09

to

I see this quite often on agents installed on virtualised hosts. I
see it very occasionally coming from a physical box. In our case I
believe it is being caused by VCB backups on our VMWare environment.
It appeasrs the synch driver brifly pausing the machine hoses the ESE
data store. Supposedly ESX 3.5 update 4 is supposed to resolve this
by using VSS instead of the synch driver?

Dean

> > > Patrick- Hide quoted text -
>
> - Show quoted text -

bubslg

unread,

Jun 2, 2009, 4:31:57 PM6/2/09

to

The proper method for clearing this is to flush the health service
state and cache. This can be accomplished in 2 ways:

1. From the console. scope yourself down to te Agent Health State.
Select the "Flush Health Service State and Cache" task form the
Actions menu.

2. Manually. Stop the health service on the affected agent. Delete
the contents of the folder "Program Files\System Center Operations
Manager 2007\Health Service State\Health Service Store". Restart the
health service.

Dean

On Jun 2, 9:15 am, Derv <D...@discussions.microsoft.com> wrote: