| Cheshire Cat Computing http://www.steveshipway.org/forum/ |
|
| EventLog agent takes forever to stop http://www.steveshipway.org/forum/viewtopic.php?f=22&t=4123 |
Page 1 of 2 |
| Author: | Bennyvision [ Tue Jan 12, 2010 10:33 am ] |
| Post subject: | EventLog agent takes forever to stop |
Hey folks, Not a real problem, really, just annoying (and the end users will surely ask about it)... When I make changes to an agent and try to restart it to pick up on those changes, it usually takes a very long time to shut down. All hosts so far are Windows 2003 Server SP2, most are 64-bit. Most of them take two or three minutes to stop. Starting them is almost instantaneous. I've done it so many times that I doubt I'm catching them in the middle of an event log run. The number of filters is very small, under 6 in all cases so far. Watching task manager does not reveal any high CPU load, high memory usage, nothing like that. It just takes a long time to stop the agent. Any thoughts? It would be great if this were faster for the users... Thanks much! Benny |
|
| Author: | stevesh [ Wed Jan 13, 2010 9:21 am ] |
| Post subject: | Re: EventLog agent takes forever to stop |
Do you have an excessive number of eventlog entries being generated? I suppose it is possible that (eg on a Domain controller) you could get dozens every second and so during the scan cycle it could have thousands to check, and if your rules are particularly complex (involving regexps and so on) it would take some time. However a slow stop would not be expected; here it stops very fast. This may be an issue with the 64bit system; it has not been much tested under 64bit. Are you using the 32bit agent or the 64bit agent? |
|
| Author: | Bennyvision [ Wed Jan 13, 2010 9:51 am ] |
| Post subject: | Re: EventLog agent takes forever to stop |
No, very few event log entries generated... In fact, one of the hosts is completely under my control for Nagios development, and it logs something *very* rarely indeed. I stand corrected, a lot of these hosts are 32-bit. Here is some data about the hosts, and how quickly the daemon restarts: Host: 64-bit VM, running Server 2003 R2 x64 SP2, EventLog agent 1.9.2.0 (slow) Host: 32-bit VM, running Server 2003 SP2, EventLog agent 1.9.2.0 (slow) Host: 32-bit VM, running Server 2003 SP2, EventLog agent 1.9.2.0 (slow) Host: 32-bit VM, running Server 2003 SP2, EventLog agent 1.9.2.0 (slow) Host: 32-bit VM, running Server 2003 SP2, EventLog agent 1.9.2.0 (slow) Host: 64-bit physical hardware, running Server 2003 R2 x64 SP2, EventLog agent 1.9.2.0 (fast) Host: 64-bit physical hardware, running Server 2003 R2 x64 SP2, EventLog agent 1.9.2.0 (fast) I'm starting to see a pattern here... While I don't know what about a VM might make it slow, could this be related to the fact that a lot of these things are virtual machines? We're running VMware ESX server on beefy hardware. Nothing else appears to be slow, just restarting this daemon. It takes an average of 2 or three minutes on the slow hosts. Thanks! Benny |
|
| Author: | Bennyvision [ Wed Jan 13, 2010 9:58 am ] |
| Post subject: | Re: EventLog agent takes forever to stop |
Another data point - I just tried restarting on a 64-bit physical host, running 2003 R2 x64 SP2, and it's taking forever. So, not *solely* a VM thing, if at all. |
|
| Author: | Bennyvision [ Wed Jan 13, 2010 10:19 am ] |
| Post subject: | Re: EventLog agent takes forever to stop |
Sorry to keep spamming you... I forgot to answer your 32 -vs- 64-bit question. I don't see any differentiation between a 32-bit or 64-bit agent on the download page... I just downloaded the first one (nagevlog-setup-1.9.2.exe) on that page, since I didn't see any specific version for 32- or 64-bit operating systems. |
|
| Author: | stevesh [ Wed Jan 13, 2010 4:49 pm ] |
| Post subject: | Re: EventLog agent takes forever to stop |
We have a lot of servers here running under VMWare ESX 3 -- no problem on any of them (that Im aware of). Our 64bit servers (also under VMWare) are running the separately compiled 64bit agent, but this is not on general release - you need to install it manually from a separate download. If you haven't explicitly installed it then the standard package doesnt contain 64bit. |
|
| Author: | Bennyvision [ Thu Jan 14, 2010 2:41 am ] |
| Post subject: | Re: EventLog agent takes forever to stop |
Are you talking about the "Beta version for 64-bit windows 2008" ? I thought that was for ... Windows 2008? That's the only hit on the entire download page for 64... Thanks! Benny |
|
| Author: | stevesh [ Thu Jan 14, 2010 9:58 am ] |
| Post subject: | Re: EventLog agent takes forever to stop |
It should work under 2003 64bit as well, although we've only tested so far under 2008 64bit. |
|
| Author: | Bennyvision [ Wed Jan 27, 2010 3:59 am ] |
| Post subject: | Re: EventLog agent takes forever to stop |
Finally got back to looking at this... I am looking at a 2008 machine now, going to try out the 64-bit version. The zip file includes the Visual C++ runtimes, nagevlog and NagEvLogCtrl. However, my host complains about missing libmcrypt when I try to fire up the controller. I guess I would have expected it to be bundled... Is there an additional package somewhere that I'm not finding? I don't see this mentioned anywhere except in the description of NagEvLog on the download page... |
|
| Author: | stevesh [ Wed Jan 27, 2010 10:10 am ] | ||
| Post subject: | Re: EventLog agent takes forever to stop | ||
Sorry - it does say beta  The libmcrypt.dll from the standard package should work for this as normal. See the attached ZIP file
|
|||
| Page 1 of 2 | All times are UTC + 12 hours [ DST ] |
| Powered by phpBB® Forum Software © phpBB Group http://www.phpbb.com/ |
|
