If you are experience an issue where events are failing to parse, and you require assistance, collect the following data, and contact support:
- A copy of the SQL ERRORLOG file from the SQL Server. It must cover the same time range as the error in the eventparser.log.
See solution 2 for collecting SQL Error logs in KB93378 - How to collect data for troubleshooting an SQL deadlock issue.
- A copy of one or more events from the <ePO_installation_directory>\DB\Events\Debug folder that generates the error, if you can reproduce the problem with one of these events.
- A copy of one or more events from <ePO_installation_directory>\DB\Events\ folder if events are accumulating in that folder.
- A Minimum Escalation Requirement (MER) from the ePolicy Orchestrator Server or agent handler which is experiencing the issue.
- When the issue only occurs on a specific managed product' events only, determine what product extension version.
Justification for data requested:
- A MER from the server is needed in case the logging alone does not fully explain the issue. Many times, other data that is included in the MER is needed, including but not limited to:
- Environmental variables
- Running processes
- Other managed products installed
- Exact version numbers for the agent, ePO, or DLLs
- The SQL ERRORLOG file on the SQL Server contains data relevant to error conditions on the SQL Server which can prove helpful in tracking the issue down.
- A copy of the event producing the error is useful because it often allows Support to reproduce the issue internally. Also, the event can be examined closely for issues that might be causing the issue, such as invalid characters.