Troubleshooting Tip: How to resolve unprocessed logon event, FSSO collector agent on polling mode on a Windows server

[gagandeeps]

Description	This article describes the optimization of the FSSO agent when the collector agent shows an unprocessed logon event in the log file.
Scope	FSSO collector agent installed on Windows server.
Solution	Error: 'Multiple unprocessed logon events in the log file from the collector agent.' 12/02/2024 11:41:12 [ 6040] unprocessed logon event:24000 12/02/2024 11:41:15 [ 4776] unprocessed logon event:23000 'Unprocessed logon events' notifications show up repeatedly in collector agent servers  if the Collector Agent is extremely busy with other processes, such as DNS lookup or polling events from domain controllers. Collector Agent builds up a queue of login events which has not processed.  Solution: Optimization of the collector agent is as follows: Increasing the Max worker thread (For Example Default 128 to 512) using Collector agent Advanced Settings -> Worker thread count , as it indicates how many parallel processing threads FSSO agent can use to handle authentication events, logon/logoff queries, and communication with domain controllers. Set log level to Debug and log size to 100 MB. Set Cache user group results to 60 Related articles: Technical Tip: Tips to optimize FSSO Collector Agent operation for CPU utilization Technical Tip: Understanding the FSSO Working DCAgent Error: 'Too many requests in the queue, discar...