Sentinel Agent Manager clearing stuck agent.

  • 7017509
  • 15-Apr-2016
  • 29-Apr-2016

Environment

NetIQ Sentinel 7.3.2
NetIQ Sentinel 7.3
NetIQ Sentinel 7.4

Situation

With Sentinel Agent Manager a deployed agent may show on-line and reporting in, but will not be sending in any event data. A quick check of the application event log will show several 21240 or 21241 events where the agent is attempting to get a new filter set from the agent manager, and will appear to update correctly, but no new events will show in the UI from this agent. Navigating to c:\programdata\netiq\security manager\(security group) shows the files that make up the core of the agent. checking the configcache.cache will show a size usually greater then 750k which means the agent has gotten stuck on a filter load and is no longer processing data.

Resolution

  1.  go to services and stop the agent manager service.
  2. Navigating to c:\programdata\netiq\security manager\(security group) 
  3. Delete Configcache.cache
  4. Restart the agent manager service
  5. 30 Seconds to a minute later the configcache,cache should reappear, and its size will be much smaller than it was before the deletion. Event transfer can take up to 10 minutes after the restarting of the service.

Cause

This can be caused my any communication glitch between the agent and the agent manager. The rule set is deployed partially or more then once which causes the agent to halt with a failed rule set.