ReadEventLog Fails with Error 87 | Log collection solutions

#1 AndyMan 5 years ago

Hi, I'm using the latest version community edition of nxlog to send data from Server 2016. The server started going crazy (CPU/Messages per second) and the eventlog has this.

Warning 8/26/2018 8:21 EvntAgnt 3006 None Error reading log event record. Handle specified is 1313800280. Return code from ReadEventLog is 87. Warning 8/26/2018 8:21 EvntAgnt 3006 None Error reading log event record. Handle specified is 1313800280. Return code from ReadEventLog is 87.

we were getting 31,000 of these events per second. Microsoft had this to say...

https://support.microsoft.com/en-us/help/177199/bug-readeventlog-fails-with-error-87

So, is there a different way to configure the nxlog so this won't occur? We just rebooted for now but I'm sure stopping/starting the service would have fixed it but they didn't know.

Permalink

#2 b0ti Nxlog ✓ 5 years ago

#1 AndyMan

Hi, I'm using the latest version community edition of nxlog to send data from Server 2016. The server started going crazy (CPU/Messages per second) and the eventlog has this. Warning 8/26/2018 8:21 EvntAgnt 3006 None Error reading log event record. Handle specified is 1313800280. Return code from ReadEventLog is 87. Warning 8/26/2018 8:21 EvntAgnt 3006 None Error reading log event record. Handle specified is 1313800280. Return code from ReadEventLog is 87. we were getting 31,000 of these events per second. Microsoft had this to say... https://support.microsoft.com/en-us/help/177199/bug-readeventlog-fails-with-error-87 So, is there a different way to configure the nxlog so this won't occur? We just rebooted for now but I'm sure stopping/starting the service would have fixed it but they didn't know.

You should be using im_msvistalog , not im_mseventlog.