Environment
AppManager 6.x
AppManager 7.0.x
Async_NTEventlog Knowledge Script
Situation
Resolution
Multiple copies of the Async_NTEventlog knowledge script should be able to run on the same agent machine.
The Async script can be less taxing on the system than running the normal General_Eventlog, but it will all depend on the type of filtering being done and how many different criteria are specified in the knowledge script in order to raise an event or not. The fewer criteria the better - ie - just search for a specific event id and not filter on event id AND a Descriptions. This will reduce the amount of parsing of the new event in the event logs.
In general, determining how many jobs, Asynchronous or not, can be run on an agent is not easy to determine. There are many different factors involved such as number of jobs, how often they are run, do they collect data, and what do they do? Saying only X number of jobs can be run is not possible as a guideline for all users in all the different network environments. At a minimum, 10 to 20 knowledge scripts should be fine.
- Ways to minimize impact on the CPU and memory:
- Schedule jobs that are currently using "regular intervals" to use a "Daily Schedule" and put a little offset into each job as to when it starts.
- Jobs can run every 5 minutes or 15 minutes, but by having the jobs staggered to run starting at 12:01, 12:02, 12:03 it will prevent the jobs from all starting at the same time, which will start happening when the NetIQ services are restarted and/or the server is rebooted. When the services are restarted ALL jobs on the server will restart at the same time and start running based on their intervals. This will cause overlaps and potentially have all jobs executing at the same time.
- By putting them to a Daily Schedule, this will be eliminated.
- Reduce the size of the NT Eventlogs. Don't let them grow uncontrollably. Set a maximum log size. The Eventlog Knowledge Script has to take a snapshot of that log file and look for changes in it. By keeping the logs small, it may help with memory usage.