Event ID 1041, Event ID 1037, Event ID 1031 seen in Event Viewer when starting the Log Archive Server (LAS) (NETIQKB72627)

  • 7772627
  • 13-Oct-2010
  • 22-Oct-2010

Environment

Security Manager 6.5.2 and earlier

Situation

Event ID 1041, Event ID 1037, Event ID 1031 seen in Event Viewer when starting the Log Archive Server (LAS)

Resolution

Service Pack 3 (SP3) for Security Manager 6.5 corrects this issue. 

Click the following link to download Service Packs for Security Manager (Note: requires access to locked resources)
https://www.netiq.com/support/sm/extended/sp.asp

Cause

The problem happens when the LAS is started and then stopped quickly with a large volume of data. The checker is running and the indexers never have time to start before the LAS is told to stop. When the shutdown command is sent to the LAS, the checker aborts, but the rest of the startup code continues, including starting the indexers. The code to stop the indexers has already passed, so they never get shutdown when the LAS stops. The next start of the LAS also starts up the indexers, and duplicate indexers start running throwing the events seen in Event Viewer.

Additional Information

Formerly known as NETIQKB72627