Processing Backlogged Events Taking a Long Time
I've a client got this error message: The Windows Event Log Provider monitoring the System Event Log is 371035 minutes behind in processing events. This can occur when the provider is restarted after being offline for some time, or there are too many events to be handled by the workflow. One or more workflows were affected by this. Workflow name: Microsoft.SystemCenter.Essentials.AUAgentUpdate.InventoryCycleRule Instance name: HK-PO.hknpl.com.hk Instance ID: {8FF0AC3C-3B0C-BD01-4C2E-FB3659ACEC6B} Management group: SCESVR_MG I tried to reinstall the agent but still failed.
October 5th, 2009 5:05am

Hi, When you reinstall the agent, do you also run the cleanup tool from the resource kit? When you have re-installed the agent, does the same event show up direct again?Anders Bengtsson | Microsoft MVP - Operations Manager | http://www.contoso.se
Free Windows Admin Tool Kit Click here and download it now
October 6th, 2009 1:03pm

How can I run the cleanup tool? I do not have the resource kit. I have got the SCE setup cd only.The same event will show up after 1 or 2 days later. But only that client have this problem. It is a Windows Vista machine.Thanks.
October 7th, 2009 7:28am

Hi Clown, Please clear the Health Service Store cache on SCE Server.The default location is:C:\Program Files\System Center Essentials 2007\Health Service State\Health Service Store.Please cleanup the content in "Health Service Store" folder. (Please stop Opsmgr Health Service First). Also, Please try to clear the cache by running the SCE console from the command line with the option: /clearcache. Example: "C:\Program Files\System Center Essentials 2007\Microsoft.EnterpriseManagement.SCE.UI.Console.exe" /clearcache
Free Windows Admin Tool Kit Click here and download it now
October 7th, 2009 2:27pm

I was stopped the Opsmgr Health Service. Deleted the files in the "Health Service Store" folder, and run the command line you tauch.But it seems cannot solve the problem. Also the management status of monitoring is "Error". All of the Windows Computer Tasks could run successfully, but unable to connect the Event Viewer in Computer Management. It says network path was not found...Thanks for help.
October 8th, 2009 8:41am

Hi Clown, Did you create any custom rules? If you have for example configure a rule incorrect it can generate a local event on the agent machine very often and that can result in this event.
Free Windows Admin Tool Kit Click here and download it now
October 12th, 2009 12:37pm

No, I did not... and I don't know how to create...How to check if there have any customize rules??Thanks a lot.
October 13th, 2009 4:53am

I've a client got this error message: The Windows Event Log Provider monitoring the System Event Log is 371035 minutes behind in processing events. This can occur when the provider is restarted after being offline for some time, or there are too many events to be handled by the workflow. One or more workflows were affected by this. Workflow name: Microsoft.SystemCenter.Essentials.AUAgentUpdate.InventoryCycleRule Instance name: HK-PO.hknpl.com.hk Instance ID: {8FF0AC3C-3B0C-BD01-4C2E-FB3659ACEC6B} Management group: SCESVR_MG I tried to reinstall the agent but still failed. I have really the same problem. It only occurs, on Windows Server 2008 R2 and Windows 7 Clients. Any hint? Any help?
Free Windows Admin Tool Kit Click here and download it now
November 3rd, 2009 10:46am

I have the same problem with our Windows 7 clients. We are running mainly XP and 2003, with 2 Windows 7 machines. Alert Description: The Windows Event Log Provider monitoring the System Event Log is 679802382 minutes behind in processing events. This can occur when the provider is restarted after being offline for some time, or there are too many events to be handled by the workflow. One or more workflows were affected by this. Workflow name: Microsoft.Windows.Client.Win7.Computer.RADAR_Error.Monitor Instance name: ukw00952.***.com Instance ID: {B9483A25-6CA0-7D30-1AD6-F676B0E1F970} Management group: UK-ABI-SIT01_MG Anyone have any idea?
November 30th, 2009 8:26pm

Hi!The problem regarding backlogged events can safely be ignored as per: http://support.microsoft.com/kb/974722 Event ID 26017 from source "Health Service Modules" will be raised for Operations Manager 2007 SP1 agents, indicating "Event log Provider monitoring the <LogName> Event Log is # minutes behind," and the number of minutes is in the hundreds of millions. Problem: When an Operations Manager 2007 SP1 agent is installed on a computer that is running Windows 7 or Windows Server 2008 R2, the following event may be logged in one or more event logs. Additionally, value for the number of minutes is very large. Log Name: Operations ManagerSource: Health Service ModulesEvent ID: 26017Level: WarningDescription: The Windows Event Log Provider monitoring the %1 Event Log is %2 minutes behind in processing events. This can occur when the provider is restarted after it is offline for some time, or there are too many events to be handled by the workflow. Impact: None. These events are generated because of the delta between timestamps is calculated incorrectly. The event log processing is actually working correctly, and the events can be ignored.Workaround: No workaround is required. Ignore the events or upgrade to Operations Manager 2007 R2. This issue will be fixed in updates that will be available in the future for Operations Manager 2007 SP1. Best regards,Michael Pultz-Hansen
Free Windows Admin Tool Kit Click here and download it now
December 21st, 2009 3:26pm

Where's the SCOM 2007 SP1 update to fix this annoyance? Win7 and Win2008 R2 have been out for over a year now!
January 7th, 2011 9:16am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics