11165 Microsoft Operations Manager Correlator Module reached the Maximum allowed queued items

Hi again!

This message gets logged in the OpsMgr Event Log only if there are correlator implementations in some custom Management packs. More about correlator here: https://msdn.microsoft.com/en-us/library/ff458713.aspx 

Event ID 11165 (Warning)

The Microsoft Operations Manager Correlator Module reached the Maximum allowed queued items for a given interval, forced Output happened.

Usually there was a change on the Agent that caused the Agent Queue to Overflow, either the Agent is a new target for some new Management packs, or the Agent was configured as multihomed.

If it`s multihomed, the error is quite expected, since the rules from the configuration get loaded per management group. If the agent is multihomed, they are loaded twice in the queue. So basically the number of workflows doubles, which of course can lead to a queue exhaustion, as the error above mentions.

The resolution for this is either to:

1. raise the agent queue size:

KLM\SYSTEM\CurrentControlSet\services\HealthService\Parameters\Management Groups\<MG NAME>\MaximumQueueSizeKb

76800 KB is the maximum size

2. Or to lower the interval under which you make the correlation, directly in the management pack. This way correlation will take more frequently place and the queue will be processed also more frequently.