Aggregation export is creating partial records at the end of the file. (NETIQKB71224)

Aggregation export is creating partial records at the end of the file.

This has been resolved in SP4. Apply SP4 to address this issue.

Aggregation export is creating partial records at the end of the file. Indexers are responding to the logoff in the HandlerRoutine() as a part of the shutdown process. When they do, we are shutting down the indexer and the service starts them right back up. After 5 failures, the services starts a shutdown process. Then in the middle of that, the service gets a shutdown call from the service control manager. This is causing the process to terminate immediately, which in turn does not allow the cube data to be flushed. Additionally, partial records are causing null guid fields on the CubeDepot. This is causing the Reporting Server job to stop.

 

A partial record may look something like this:

 

Windows {CB1CC018-F1D3-4F8C-9B21-EE6E35BB1C03} HOSTNAME01 4/17/2009 10:25:10 PM -240  10.21.105.23 1604  Low    565 Secu        

Whereas a completed record should look like this:

Windows {CB1CC018-F1D3-4F8C-9B21-EE6E35BB1C03} HOSTNAME01 4/17/2009 10:25:10 PM -240  10.21.105.23 1604  Low    565 Security        HOSTNAME01        Windows {CB1CC018-F1D3-4F8C-9B21-EE6E35BB1C03} HOSTNAME01 4/17/2009 10:25:10 PM -240  10.21.105.23 1604  Low    565 Security        HOSTNAME01        

Formerly known as NETIQKB71224

Stabilize the data for upload to the SMCubeDepot and stabilize the NetIQ Log Archive Service.