Log Archive Server (LAS) has corrupt data and indexing failures (NETIQKB71678)

On the LAS server there are corrupt message blocks with a .bad extension being sent to the index_data folder, subsequently there are numerous indexing failures. the indexer was receiving incomplete input (because the .NET bug caused the LAS to abort block processing in the middle of creating the input file for the indexer) and the indexer was renaming the incomplete input files to have the .bad extension.

SM versions 6.0 SP3 and earlier, the LAS repeatedly stops and there is a message in the netiq.logarchive.import message queue that never gets processed.

SM versions 6.0 SP5 and 6.5, the LAS writes event 1008 (?An invalid message () was retrieved from the queue?) to the Windows Application event log and then moves the message to the ?LogArchive Invalid Messages? folder under ?%ALLUSERSPROFILE%\Application Data\NetIQ\Security Manager?; also the log archive index_data folder contains files with the .bad extension.

Install at minimum .Net 2.0 Framework SP1.   It is recommended to apply all hot fixes and updates to the .Net framework.

Versions of the .NET Framework

The released versions of the .NET Framework have the following version information.

.NET Framework version	Revision	Version
3.5	Original release	3.5.21022.8
3.5	Service Pack 1	3.5.30729.1
3.0	Original release	3.0.4506.30
3.0	Service Pack 1	3.0.4506.648
3.0	Service Pack 2	3.0.4506.2152
2.0	Original release	2.0.50727.42
2.0	Service Pack 1	2.0.50727.1433
2.0	Service Pack 2	2.0.50727.3053
1.1	Original release	1.1.4322.573
1.1	Service Pack 1	1.1.4322.2032
1.1	Service Pack 1 (Windows Server 2003 32-bit version*)	1.1.4322.2300
1.0	Original release	1.0.3705.0
1.0	Service Pack 1	1.0.3705.209
1.0	Service Pack 2	1.0.3705.288
1.0	Service Pack 3	1.0.3705.6018

*The Microsoft .NET Framework 1.1 is included with the 32-bit version of Windows Server 2003.

Note This information should be used as a general guide for determining which versions of the .NET Framework are installed on a computer. Be aware that files that have a later version number may be files that were included in a hotfix or a hotfix rollup package. These versions are outside the scope of this article.

There is a bug in the .Net 2.0 Framework

Formerly known as NETIQKB71678

How to determine which versions of the .NET Framework are installed

To determine which versions of the .NET Framework are installed, locate the %systemroot%\Microsoft.NET\Framework folder. To open this folder, you can paste this address into a Windows Explorer address bar. The following folders contain the released versions of the .NET Framework:

                               v3.5

                               v3.0

                               v2.0.50727

                               v1.1.4322

                               v1.0.3705

Note If you see other folders that have a vN.N.NXXXX format, they may contain beta versions or pre-released versions of the .NET Framework. Those versions are outside the scope of this article.

To determine which versions of the .NET Framework are installed on a computer, follow these steps:

1.                          Open any one of the folders in the previous list.

2.                          Right-click the Mscorlib.dll file, and then click Properties.

3.                          Click the Version tab, and then note the file version.

4.                          Use the previous list to determine which version of the .NET Framework is installed on the computer, and then click OK.

Repeat these steps for each version of the .NET Framework on the computer.