Log Insight 4.3 error

[JT_CPL]

One of the Windows agent is crashing and won't start and continuously retry and created log file (currently over 200k log files created....)

1. What would be causing the following error?

2017-07-12 16:14:49.518928 0x00003438 <error> AgentDaemon:344    | AgentDaemon - EXCEPTION: Can't deserialize Event attributes count, uint64_t type expected

This is on Windows Server 2008 R2 with Log Insight Agent 4.3.0.5052904

2. How can the local log file get rotated or limited?  This is a runaway process.

[admin]

Can you please get an agent support bundle? We will take a look.

[JT_CPL]

Reinstalled agent, didn't want to wait too long for troubleshooting.  Now I'll have to check few thousand machine make sure the agent is not doing the same thing.  Because if it did, log files build up and takes up all of C drive.... there are no controls on this.

[admin]

Ok, please let us know if you see it again and do get an agent support bundle if you can so we can analyze it further.

[admin]

> 1. What would be causing the following error?

The event disk storage db corruption can cause this. For investigation we need the agent support bundle and in this case the storage itself ("C:\ProgramData\VMware\Log Insight Agent\storage\liagent.db"). Please note that the storage contains actual events/logs collected from system and can contain some sensitive data.
Have you installed the agent from scratch or you have updated it from some old version?

Have you experienced any kind of crash or file system corruption in the system?

>2. How can the local log file get rotated or limited?  This is a runaway process.

The agent handles it's own logs rotation and retention by itself. The total logs size cannot exceed 50MB size.

[JT_CPL]

Thanks for the information however I think #2 is incorrect for the 50MB limit.

Most of the agents log "folder" are over 50MB.  The runaway one was over 600MB with 200,000 log files.

[admin]

This is really weird. Can you please send me the support bundle?
Please run agent support bundle utility installed with agent.
If it's too big then please manually zip the first and couple of very last log files and send it to me.

Is this happens only on the system where you see the above mentioned error?