Event Log Monitor is consistently busy and not able to run. It should run every 1h 0m, but has been stuck in Monitor Busy for 1d 1h 21m

hajose 22
Viewed 0

Hi everyone!

Since last Sunday PA Monitor can not monitor Event log on every single servers. I tried suggestions what I have read here, but none of them worked. For rxample: inbound rules on Firewall settings, rebuild and/or reorg indexes in database And my ideas: restart service, restart server, checking technincal user that runs PA service to able to login remote servers, checking its permissions, etc.

Strange experience: I have deleted Event log monitor, and tried to create new Event log monitor, but I cannot. The Pa monitor consolse has frozen.

Any idea? thanks a lot

eventlog poweradmin
1 Answers

There are two Event Log APIs in Windows - the "Evt" API and the legacy API. The Evt API is supposed to work on all servers that are 2008 or newer, and it is the only one that can access all of the Event Logs (the legacy API can only get to Application, System and Security).

Since the Evt API is available on Windows Server 2008 and newer we switched to forcing that API to be used in 9.5.

You can enable the older API to be used again by setting this registry value:

HKLMsoftwarePAServerMonitor

Evt_ForceEvt2 = 0

Restart the PA Server Monitor service after making this change.

Doug1126
Related