Monitor Eventlog on Win Server issues

[jroberson]

I have set up eventlog monitoring on other systems and have run into an issue on this particular host. This is the error in the agent log:

Get active checks error: Cannot connect to [172.17.1.50:10051] [An operation on a socket could not be performed because the system lacked sufficient buffer space or because a queue was full.]

This server has been running for a while and the eventlog is pretty full. I assume that this error is because of that, and I can probably just clear out the eventlogs and it should start working...maybe.

I would like to know if anyone found a way to increase the "buffer" or a way to just send new events, etc. Any suggestions would be appreciated. Thanks!

[jroberson]

... I can probably just clear out the eventlogs and it should start working...maybe

NOT!!

OK, I cleared the eventlog and now I still get the same error. I restarted the agent and it still will not work. Looks like something is wrong! I'm using 1.6.4 agents and server, this is a Win2003 host, and I set it up just like I did other systems that don't have this issue. Anybody have any ideas? Thanks in advance.

[jroberson]

Might have "fixed" it. Here's a novel idea, restart the server ...

When I did that it started to work. Though it may point to another issue with the server. I found an interesting possible reason for this error message at this link. My issue wasn't with the /PAE or /3gb switch in the article but I believe it had something to do with the so called "ephemeral" ports. I have no evidence, it just sounds cooler.

[joseperes]

I have the same issue, my Zabbix agent 4.0.0 is not working... here is the log:

63032:20191226:084514.672 active check configuration update from [10.12.28.250:10051] started to fail (cannot connect to [[10.12.28.250]:10051]: [0x00002747] An operation on a socket could not be performed because the system lacked sufficient buffer space or because a queue was full.)