Slow GPG performance (NETIQKB49892)

  • 7749892
  • 02-Feb-2007
  • 15-Mar-2013

Environment

NetIQ Group Policy Guardian 2.0

Resolution

Fact

NetIQ Group Policy Guardian 2.0

Symptom

Slow Group Policy Guardian (GPG) performance

EventAudit.exe consuming significant CPU resources

Thousands or even millions of messages stored in MSMQ (Microsoft Messaging Queue)

Cause

Performance issues may be due to inefficient WMI queries that take longer to complete when there are high numbers of events in the event log.

Fix

You may be able to resolve GPG performance or EventAudit.exe CPU resource issues by applying Group Policy Guardian (GPG) 2.0 SP1 to your GPG Collector computers and Microsoft hotfix 902346 to any Windows Server 2003 domain controllers that the Collectors are monitoring. Applying the GPG service pack and the Microsoft hotfix enables GPG to utilize optimized WMI queries when examining domain controller event logs. Microsoft hotfix 902346 requires Windows Server 2003 SP1 or later.

For more information about GPG 2.0 SP1, see: NETIQKB50131. To obtain hotfix 902346, which is unpublished at this time, contact Microsoft for Windows 2003 Server support by email or phone using the contact information available at support.microsoft.com.

If you have a mixed environment of Windows 2000 and Windows 2003 domain controllers, you can still apply GPG 2.0 SP1 and Microsoft hotfix 902346 to any Windows 2003 domain controllers you are monitoring.

You may also be able to address performance issues by reviewing your event auditing policies. Reducing the number of events you are auditing will reduce the number of messages stored in MSMQ and also reduce the number of events that EventAudit.exe must evaluate.

For more information, please contact NetIQ Technical Support at www.netiq.com/support .

Additional Information

Formerly known as NETIQKB49892