Cheshire Cat Computing

I'm seeing the following Error on the Event log in one of my servers:

Event Type: Error
Event Source: NagiosEventLog
Event Category: None
Event ID: 0
Date: 5/14/2008
Time: 8:41:48 PM
User: N/A
Computer: SERVER
Description:
Insufficient read buffer: 523264 configured; 682664 required

Is the read buffer something that can be configured from the Nagios Eventlog Service Control Manager or perhaps changing a key on the Registry?

I hope a re-compile is not needed to fix this.

Can anyone advise?

Thank you . . .

This is a new one for me. I'm not sure why it would be needing a 600K+ read buffer, either, as all it does is forward alerts.

I've searched the code and it comes from a library routine. Can you let me know:

1. Your OS version
2. If you have exceptionally complex filter definitions?
3. Do you have eventlog entries with exceptionally large attached data? You may not be able to tell this easily. Does this machine have some unusual software installed?

Possibly a dump of the error log around the time this appears would be useful for me, too, if you can send me that to check.

_________________
Steve Shipway
UNIX Systems, ITSS, University of Auckland, NZ
Woe unto them that rise up early in the morning... -- Isaiah 5:11

Hi Steve,

Thanks for your prompt response . . .

Here's the info:

1. OS Version: Windows 2000 SP4 (5.00.2195)
2. If you have exceptionally complex filter definitions?

I don't think they're too complex, 9 filters configured:

a) System Event Log, Warning, Error, Source: Srv
b) System Event Log, Error, Source: service control manager
c) System Event Log, Error, Source: Foundation Agents
d) System Event Log, Warning, Error, Source: clussvc
e) Application Event Log, Error, Source: mssqlserver
f) Application Event Log, Error, Source: mssqlL$instance1
g) Application Event Log, Error, Source: mssqlL$instance2
h) Application Event Log, Error, Source: msdtc
i) Application Event Log, Error, Source: sqlserveragent

As you can see I'm not using any inverse logic (NOT).

3. Do you have eventlog entries with exceptionally large attached data? You may not be able to tell this easily. Does this machine have some unusual software installed?

I dind't find any unusual event, with large attached data. At least not on the events I have checked so far. No unusual software, it's a cluster node running a SQL Server.

I can provide you the Event log dump but I'd prefer to send it to you by email since it may contain some sensitive information.

Thanks a lot . . .

Please email me the eventlog dump on steve @ steveshipway.org and I'll take a look. Dont post it here, it would be too big in any case. Can you send me a dump of about 10 mins around the time of the error message (so hopefully I can see the message that triggerred the problem)

Your OS shouldn't have any problems - we've run it on Win2k here for years with no issue.

Do you get this message oftem, or just occasionally? Does the nagevlog daemon die or continue to run?

Thanks,


Steve

_________________
Steve Shipway
UNIX Systems, ITSS, University of Auckland, NZ
Woe unto them that rise up early in the morning... -- Isaiah 5:11