Troubleshooting Tip: How to resolve unprocessed logon event, FSSO collector agent on polling mode on a Windows server

Error: 'Multiple unprocessed logon events in the log file from the collector agent.'

12/02/2024 11:41:12 [ 6040] unprocessed logon event:24000
12/02/2024 11:41:15 [ 4776] unprocessed logon event:23000

'Unprocessed logon events' notifications show up repeatedly in collector agent servers  if the Collector Agent is extremely busy with other processes, such as DNS lookup or polling events from domain controllers. Collector Agent builds up a queue of login events which has not processed. 

Solution:

Optimization of the collector agent is as follows:

1. Increasing the Max worker thread (For Example Default 128 to 512) using Collector agent Advanced Settings -> Worker thread count , as it indicates how many parallel processing threads FSSO agent can use to handle authentication events, logon/logoff queries, and communication with domain controllers.
2. Set log level to Debug and log size to 100 MB.
3. Set Cache user group results to 60

Related articles:

Technical Tip: Tips to optimize FSSO Collector Agent operation for CPU utilization

Technical Tip: Understanding the FSSO Working DCAgent Error: 'Too many requests in the queue, discarding this logon event'