uberAgent Support

Issues When Upgrading Windows

Cause

uberAgent keeps track of which event log records it has processed by storing the last event's record ID. When you upgrade Windows, e.g. from Windows 8 to Windows 10 or from Windows 10 1607 to Windows 10 1703, record IDs are reset, so that events on the new OS have much smaller record IDs than events on the old OS.

Effect

This causes uberAgent to ignore any new incoming events. As a consequence, features that rely on data from the Windows event logs do not work correctly any more. This primarily affects logon monitoring.

Solution

To resolve this issue delete uberAgent's record record ID cache.

The cache is located in the following registry key:

HKLM\SOFTWARE\vast limits\uberAgent

After deleting above key restart the uberAgent service.

Have more questions? Submit a request

0 Comments

Please sign in to leave a comment.
Powered by Zendesk