IJ37883: WINDOWS OS AGENT 32-BIT (6.30 FP7 SP6 AND LATER) STOPS WHEN PROCESSING EVENT LOG MESSAGES.

APAR status

• Closed as program error.

Error description

• Starting with 6.30 FP7 SP6, the Monitoring Agent for Windows OS
  32-bit agent will stop running when monitoring messages using
  the Event Log attribute group.
  The issue occurs when processing an event log message that has
  been written to an event log that is being monitored by the
  agent.  Until a log file message is processed, the agent will
  run as expected.
  
  This can also affect remote deploying updates to the system
  where the Windows OS Agent 32-bit agent is running since it
  might stop running before a remote deploy update is complete.
  
  
  Log:
  With tracing set to (UNIT:kntel ALL), the log file
  <hostname>_nt_kntcma_<timestamp>-0<n>.log will show the
  "process_events" message at the end of the log and does not
  return:
     (620C0D9A.008F-2E4:kntelagt.cpp,1998,"process_events") Entry
  

Local fix

• Workarounds:
  1.  Stop the situations/historical collections for the Event Log
  attribute group (KNT.NTEVTLOG).  There are two default
  situations that use this attribute group:
         NT_Service_Error
         NT_Invalid_Logon_Attempt
      These should be stopped as well as any others that are
  running.
  
      The %CANDLE_HOME%\TMAITM6\Primary_<hostname>_NT.LG0 will
  show the situations/historical collections for that attribute
  group which are running.
       Restart the agent.
  
  2.  Upgrade the OS Agent to the 64-bit version.  This is
  recommended in general.
  

Problem summary

• Windows OS Agent 32-bit crashes on 6.30 FP7 SP6 and above.
  
  
  Starting with 6.30 FP7 SP6, the Monitoring Agent for Windows OS
  32-bit agent will stop running when monitoring messages using
  the Event Log attribute group.  The issue occurs when processing
  a pure event log message that has been written to an event log
  that is being monitored by the agent.  Until a log file message
  is processed, the agent will run as expected.
  This can also affect remote deploying updates to the system
  where the Windows OS Agent 32-bit agent is running since it
  might stop running before a remote deploy update is complete.
  

Problem conclusion

• The issue was due to a change in the Microsoft compiler where
  the time_t size is changed from a size of 4 to 8.  The TEMA code
   was changed, for backwards compatability, to keep the size at
  4.  The agent code was using a size of 8 and the mismatch caused
   the crash to occur when pure events were sent up to TEMA.
  
  
  The fix for this APAR is contained in the following maintenance
  packages:
  
     | service pack | 6.3.0.7-TIV-ITM-SP0012
  

Temporary fix

• Stop the situations/historical collections for the Event Log
  attribute group (KNT.NTEVTLOG).  There are two default
  situations that use this attribute group:
         NT_Service_Error
         NT_Invalid_Logon_Attempt
      These should be stopped as well as any other Event Log
  sitautions that are running.
      The %CANDLE_HOME%\TMAITM6\Primary_<hostname>_NT.LG0 will
  show the situations/historical collections for that attribute
  group which are running.
       Restart the agent.
  

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  ITM AGENT WINDO

• Fixed component ID

  5724C040W

Applicable component levels