Why do I see informational events in the application event log when events are disabled? (NETIQKB72587)

Why do I see informational events in the application event log when events are disabled?

After making a change to the EventLogLevel registry key on an agent machine and restarting the agent services, events that should be omitted are still being generated in the Application event log.

To disable or change the levels of events shown for agent events:

1. Open the registry on the agent machine using REGEDIT.
2. Navigate to the following key:
   • HKLM\SOFTWARE\NETIQ\APPMANAGER\4.0\NETIQMC\CONFIG
3. Modify the EventLogLvl key using the following decimal values:
   • 0 = Do not log any events.
   • 1 = Log informational events only.
   • 2 = Log warning events only.
   • 3 = Log error events only.
     • Values can be added together to combine the events logged.  For example '5' would log information and error events.
4. Restart the NetIQ agent services.

To disable Administrative events, as these type of events can only be toggled on or off, use the following process:

1. Open the registry on the agent machine using REGEDIT.
2. Navigate to the following key:
   • HKLM\SOFTWARE\NETIQ\APPMANAGER\4.0\NETIQCCM\ADMIN
3. Modify the DisableAdminEvnt value changing it from a 0 to a 1.
4. Restart the NetIQ Agent Services.

The NetIQ AppManager agent generated two types of events.  It can generate an Event log message, and an Administrative message.  Both types of events are displayed in the Application event log on the agent that has detected the event.  These events cant be controlled on two different ways, depending on the source of the event.

Formerly known as NETIQKB72587