3 Replies Latest reply on Jun 23, 2015 1:38 PM by wwarren

    Event ID 5025

    dingoberry

      Hello Everyone,

       

      I am seeing the following events being logged in our application log and I am wondering what exactly is the problem and what can I do to stop/prevent it from occurring. I have tried searching the web, but have not found anything that is usefully.

       

      Type:Warning
      Source:McLogEvent
      Event ID:5025
      Event Time:6/23/2015 2:29:40 AM
      User:NT AUTHORITY\SYSTEM
      Computer:Magellan3.specservices.int

      Description:

      The alert queue has grown too big.

      Only the alert dialog and the report file will be used for

      logging virus alerts until existing alerts in the queue have been processed.

       

      Type:Information
      Source:McLogEvent
      Event ID:5026
      Event Time:6/23/2015 2:30:03 AM
      User:NT AUTHORITY\SYSTEM
      Computer:Magellan3.specservices.int

      Description

      Full logging has restarted.

        • 1. Re: Event ID 5025
          wwarren

          You'll want to review what alerts you're getting.

          Apparently it's a lot of them in a short amount of time? Perhaps you can confirm.

           

          Find out why those alerts are occurring, and fix the problem. Then you indirectly solve this one - because, there isn't anything you can do to solve these events directly. They occur as a consequence of high frequency alert generation (and then recovery from such).

          • 2. Re: Event ID 5025
            dingoberry

            These event are generated like every other day, so they do not occurs that often, but when they do occur I am at a lost to what cause them. From what I can see from the EPO console this issue usually starts when a on-demand scan is taking place.

            Furthermore this issue just recently started occurring when we had update our VSE to patch 5, so I dont know if this was by designed, a real issue, or a defect from updating to patch 5.

            • 3. Re: Event ID 5025
              wwarren

              I see. So if you're not seeing other events being generated then it suggests the 5025 is erroneous.

              We'd want to understand that behavior better. I suggest contacting Support so we can look into it further, and find out what alerts are queuing up (since you don't appear to be seeing others alerts).