Machines' status doesn't change or events are not registering on Administration server [KSC for Windows]

[Antipova Anna]

Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials.

KSC13 introduced a feature that limits the frequent publication of events. In the event that the event storage overflows on the Server, the most common event in the storage is calculated, and such events are blocked when published on hosts.

Problem:

• Machines have status "Virus scan wasn't performed for a long time" but the "Virus scan" task was started recently.
• Events that occur on local hosts (KES) are not displayed on the administration server (KSC).

Cause:

KSC 13 has a new functionality to limit the storage of frequent events. When the set event storage limit on the Administration Server is reached, the most frequently occurring event (in the database) is calculated and added to the block-list.

After that, the events that occur and are displayed on the KES hosts, when received by the server, will be blocked and will not appear in the storage. This gives rise to a problem with updating host statuses on server - since the event was not written to the database, then server-side processing does not occur and the host in the Managed group does not receive the status update.

Solution:

Since this problem is directly related to the storage and publication of events, it is first of all necessary to find out what causes the event store to overflow:

• Find out which events appeared in the block list of the Administration Server ("Managing frequent events blocking" article).

After finding out the cause of the overflow, the following can be done to fix the problem:

• Increase the number of events stored on the server database ("Setting the maximum number of events in the event repository")
• Set up event logging by deleting irrelevant ones and thereby reducing the flow of events stored on the server.
• Clear the block list for events on the administration server ("Removing blocking of frequent events")