Environment
Situation
NT_SystemUpTime reports system bounced but it did not.
Resolution
If there was no reboot, confirm the following:
1. Event log entry in the application log indicating a reboot.
2. Have the NetIQ agent services been continually running, or was it stopped and then restarted recently?
3. Compare the perfmon counter against the data in the INI file.
To resolve the issue do the following:
1. Stop the NetIQ agent services
2. Delete the sysupt_xx.ini located in the ...netiq\temp folder
3. Cold start the NetIQ agent services with the -o start parameter
Cause
The way the NT_SystemUpTime script works to monitor system uptime is that it reads the perfmon counter system uptime object. This value is written to a temp file named sysupt_xx.ini located in the ...netiq\temp folder. When the machine reboots, we read the perfmon counter and compare it to the ini file and report back on the difference in data, via UTC time.