Environment
Situation
Error: 'The description for Event ID [260] in Source [NetIQNTLog] cannot be found.'
The local computer cannot display messages from a remote computer.
Resolution
To update the Registry with the correct value:
- Click Start> Run.
- Enter regedit.
- Browse to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\NetIQNTLog\EventMessageFile.
- Change the file name from NetIQNTLog.exe to NQGenericMSG.dll.
Cause
The AppManager Agent upgrade process (5.x to 6.x) fails to update the following registry value with the correct filename HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\NetIQNTLog\EventMessageFile.
For example, an event created by the Action_NTEventLog Knowledge Script should report:
The following is the message from NetIQNTEventLog action: JobID = 18. KSName = NTMemUtil MC Machine = PINE Severity = 1 Object Name = <NT_VirtualMemObj:VirtualMemory> EventID = 22 SiteID = MAPLE1132215575 EventMsg = Virtual Memory Usage High LongMsg = Virtual Memory Usage%9.38; > TH = 5)
However, the event actually reports:
The description for Event ID [260] in Source [NetIQNTLog] cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. The following information is part of the event: Virtual Memory Usage High Time of Event: 18/11/2005 11:34:26 AM JobID:32 Source Machine Name: PINE EventSeverity:1 KS Name: NT_MemUtil Object Name: Virtual Memory AppManagerEventID:34 DetailMessage: Virtual Memory Usage% is 8.53;>TH = 5.)