Solution: The ACS forwarder in Operations Manager 2007 may frequently log connection and disconnection events


image Here’s an issue I came across recently that I thought would be worth a mention here on our blog.  The issue is one where the ACS forwarder service shows frequent connections and disconnections on Windows XP POS computers but it could happen on any ACS Forwarder if the accounts being used or the permissions are configured incorrectly.  But first a little background:

The ACS Forwarder is a separate service (AdtAgent.exe) called the Operations Manager Audit Forwarding Service.  It is deployed automatically with the Operations Manager 2007 agent but must be explicitly enabled to initiate security log collection. The Operations Manager Audit Forwarding Service listens to the local Windows Event Log service and processes security events, in near real-time, then forwards the events to a central collector. During failover and connectivity outages the local Security log acts as the Forwarding Service queue.

After you install the ACS Collector and database you can then remotely enable this ACS Forwarding Service on agents through the Operations Manager 2007 console by running the Enable Audit Collection task.  By default the ACS Forwarding service runs using the Network Service Account, but since in Windows XP POS it does not have read permission on the security event log you may see frequent connection and disconnection events logged in the Operations Manager event log on the ACS Collector server:

Log Name: Operations Manager
Source: AdtServer
Date:
Event ID: 4628
Task Category: None
Level: Information
Keywords: Classic
User: NETWORK SERVICE
Computer:
Description: An Audit Forwarder connected.
Name: <>
Address: <>
Port: 266
DbId: 2
Value: 1

Log Name: Operations Manager
Source: AdtServer
Date:
Event ID: 4629
Task Category: None
Level: Warning
Keywords: Classic
User: NETWORK SERVICE
Computer: <>
Description: An Audit Forwarder disconnected.
Name: <>
DbId: 2
Value: 1
Reason: Forwarder initiated disconnect or connection broken.

Log Name: Operations Manager
Source: AdtServer
Date:
Event ID: 4628
Task Category: None
Level: Information
Keywords: Classic
User: NETWORK SERVICE
Computer: <>
Description: An Audit Forwarder connected.
Name: <>
Address: <>
Port: 2314
DbId: 2
Value: 1

For detailed troubleshooting you can enable debugging for the ACS Forwarder and gather more information. To enable verbose logging on a local Forwarder, create a new registry value and restart the AdtAgent service as shown below.  Just remember to turn off debugging when completed.

1. Browse to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AdtAgent\Parameters

2. Create DWORD value = TraceFlags and set it to a decimal value of 524420.

3. Restart AdtAgent service.

4. Review log, C:\Windows\Temp\AdtAgent.log.  You’ll probably see something similar to this:

[20100420 143003,721][Error  ]EventLogReader::Open(0x1520): 0x00000522
[20100420 143003,721][Error  ]OpenReaders(): EventReader::Open(Security) returned 0x00000522.
[20100420 143003,721][Warning]AgentRun(): Transmit() returned 0x00000522
[20100420 143003,721][Info   ]AgentRun(): Disconnecting after Transmit() returned 0x00000522.

Error Number 0x00000522 resolves to "A required privilege is not held by the client"

5. Turn off debugging when done by removing above created DWORD and restarting the AdtAgent service.

Resolution

There are two resolutions to fix this issue.

1. Grant Read permission on the security event log for the Network Service account.  For information on this see the following Knowledge Base article:

KB323076 – How to set event log security locally or by using Group Policy in Windows Server 2003

or

2. Change the “Log on As” value for the ACS Forwarding service from “Network Service” to “Local System”.

Hope this helps,

Dipesh Kumar Rathod | System Center Support Engineer

clip_image001 clip_image002

Bookmark and Share

Comments (2)

  1. show box says:

    Thanks for the great info. I really loved this. I would like to apprentice at the same time as you amend your web site, how could i subscribe for a blog site?
    For more info on showbox please refer below sites:
    http://showboxandroids.com/showbox-apk/
    http://showboxappandroid.com/
    Latest version of Showbox App download for all android smart phones and tablets.
    http://movieboxappdownloads.com/ – It’s just 2 MB file you can easily get it on your android device without much trouble. Showbox app was well designed application for android to watch movies and TV shows, Cartoons and many more such things on your smartphone.
    For showbox on iOS (iPhone/iPad), please read below articles:
    http://showboxappk.com/showbox-for-ipad-download/
    http://showboxappk.com/showbox-for-iphone/
    Showbox for PC articles:
    http://showboxandroids.com/showbox-for-pc/
    http://showboxappandroid.com/showbox-for-pc-download/
    http://showboxforpcs.com/
    There are countless for PC clients as it is essentially easy to understand, simple to introduce, gives continuous administration, effectively reasonable. it is accessible at completely free of expense i.e., there will be no establishment charges and after establishment
    it doesn’t charge cash for watching films and recordings.
    http://www.showboxforipad.org/showbox-apk/ Not simply watching, it likewise offers alternative to download recordings and motion pictures. The accompanying are the strides that are to be taken after to introduce Showbox application on Android. The above
    all else thing to be done is, go to the Security Settings on your Android telephone, Scroll down and tap on ‘Obscure sources’.
    http://www.showboxforipad.org/
    http://movieboxappdownloads.com/moviebox-apk-android/
    http://movieboxappdownloads.com/download-moviebox-pc/
    Movie Box, an esteemed movies application in which you can find stacks of programs and films. The guide is given here to download Movie Box app to Android and to Apple iOS 9.0.2, iOS 8.4/8.3 and also for the lower versions without Jailbreak.
    http://showboxforiphone.org/
    Please do login to Showbox application with the help of Ymail. You can login in Ymail from here –
    http://ymaillogintips.com/
    Sign Up & Do registration for latest movies on Showbox application

  2. show box says:

    Thanks for the great info. I really loved this. I would like to apprentice at the same time as you amend your web site, how could i subscribe for a blog site?
    For more info on showbox please refer below sites:
    http://showboxandroids.com/showbox-apk/
    http://showboxappandroid.com/
    Latest version of Showbox App download for all android smart phones and tablets.
    http://movieboxappdownloads.com/ – It’s just 2 MB file you can easily get it on your android device without much trouble. Showbox app was well designed application for android to watch movies and TV shows, Cartoons and many more such things on your smartphone.
    For showbox on iOS (iPhone/iPad), please read below articles:
    http://showboxappk.com/showbox-for-ipad-download/
    http://showboxappk.com/showbox-for-iphone/
    Showbox for PC articles:
    http://showboxandroids.com/showbox-for-pc/
    http://showboxappandroid.com/showbox-for-pc-download/
    http://showboxforpcs.com/
    There are countless for PC clients as it is essentially easy to understand, simple to introduce, gives continuous administration, effectively reasonable. it is accessible at completely free of expense i.e., there will be no establishment charges and after establishment
    it doesn’t charge cash for watching films and recordings.
    http://www.showboxforipad.org/showbox-apk/ Not simply watching, it likewise offers alternative to download recordings and motion pictures. The accompanying are the strides that are to be taken after to introduce Showbox application on Android. The above
    all else thing to be done is, go to the Security Settings on your Android telephone, Scroll down and tap on ‘Obscure sources’.
    http://www.showboxforipad.org/
    http://movieboxappdownloads.com/moviebox-apk-android/
    http://movieboxappdownloads.com/download-moviebox-pc/
    Movie Box, an esteemed movies application in which you can find stacks of programs and films. The guide is given here to download Movie Box app to Android and to Apple iOS 9.0.2, iOS 8.4/8.3 and also for the lower versions without Jailbreak.
    http://showboxforiphone.org/
    Please do login to Showbox application with the help of Ymail. You can login in Ymail from here –
    http://ymaillogintips.com/
    Sign Up & Do registration for latest movies on Showbox application