Previous Topic: The Text File Log Sensor Running on a Solaris Agent System Stops Receiving Events

Next Topic: Appliance (non-UI)

Very High Event Flow Causes the Agent to Become Unresponsive

Symptom:

A CA Enterprise Log Manager agent becomes unresponsive and stops accepting events. The following error message appears in the caelmdispatcher.log file:

[275] 07/12/10 14:32:05 ERROR :: FileQueue::PutEvents Unable to write to new event file
[275] 07/12/10 14:32:05 ERROR :: WriterThread::run Unable to push events to FileQueue, Retrying
[275] 07/12/10 14:32:10 NOTIFY :: FileQueue::UpdateCurrentWriterFile Reached Max files configured limit=10, Not creating any new files for now

Solution:

This indicates that there is a very high rate of incoming events for the hardware in the environment. You can address this issue by reconfiguring the agent, using the following procedure:

  1. Click Administration, the Log Collection subtab, and expand the Agent Explorer folder.
  2. Select the agent you want to reconfigure, click Edit, and adjust the following parameters:
    Max Number of Files

    Sets the maximum number of files that can be created in the event reception file queue. The Max Number limit is 1000 files. The default setting is 10.

    Max Size per File

    Sets the maximum size, in MB, for each file in the event reception file queue. When a file reaches the maximum size, CA Enterprise Log Manager creates a new file. The Max Size limit is 2048 MB. The default setting is 100 MB.

    You can adjust these parameters upwards as required by your environment and event per second rate.