[GH-ISSUE #1404] An abnormally large number of event logs prevents TacticalAgent from querying or viewing the event logs #877

New issue

Open

opened 2026-03-02 02:19:40 +03:00 by kerem · 1 comment

kerem commented

2026-03-02 02:19:40 +03:00

Owner

Originally created by @NiceGuyIT on GitHub (Jan 16, 2023).
Original GitHub issue: https://github.com/amidaware/tacticalrmm/issues/1404

Server Info (please complete the following information):

OS: Ubuntu 20.04.4 LTS
Browser: Firefox 108.0.2
RMM Version (as shown in top left of web UI): v0.15.6

Installation Method:

Standard
Docker

Agent Info (please complete the following information):

Agent version (as shown in the 'Summary' tab of the agent from web UI): Agent v2.4.4
Agent OS: Windows Server 2019 Standard, 64 bit v1809 (build 17763.3770)

Describe the bug
Due to various reasons, the event logs may contain thousands or tens of thousands of records. With a large number of records, TacticalRMM returns an error: 400 bad request

To Reproduce
Steps to reproduce the behavior:

Find a system that has 10's of thousands of events. One such way is explained on a Discord thread.
Remote Background > Event Log
Add a search term to query the logs.
If necessary, increase the number of days.
Tactical will return "400 bad request" and "Unable to contact agent" error messages.

Expected behavior
It would be nice if Tactical handled the situation gracefully. This could be done using pagination for the events, or perform the search on the agent instead of the server (or browser?). A simple solution is to return the first X records with a message that the rest were truncated due to volume. If the error is due to timeout, maybe provide a message that the agent timed out after X seconds.

Screenshots
Here's the error message when showing the last 1 days. It's unclear if it's due to the number of events or a timeout when gathering the events.

Additional context
A better error message would help with the troubleshooting effort.

As explained in the Discord thread above, querying Win32_Product will cause a bunch of "Windows Installer reconfigured the product" messages in the event logs. This is explained in Microsoft's KB articles. The suggestion to use Win32reg_AddRemovePrograms is not a perfect replacement as that causes an error. There currently are 3 scripts that use Win32_Product.

Originally created by @NiceGuyIT on GitHub (Jan 16, 2023). Original GitHub issue: https://github.com/amidaware/tacticalrmm/issues/1404 **Server Info (please complete the following information):** - OS: Ubuntu 20.04.4 LTS - Browser: Firefox 108.0.2 - RMM Version (as shown in top left of web UI): v0.15.6 **Installation Method:** - [x] Standard - [ ] Docker **Agent Info (please complete the following information):** - Agent version (as shown in the 'Summary' tab of the agent from web UI): Agent v2.4.4 - Agent OS: Windows Server 2019 Standard, 64 bit v1809 (build 17763.3770) **Describe the bug** Due to various reasons, the event logs may contain thousands or tens of thousands of records. With a large number of records, TacticalRMM returns an error: 400 bad request **To Reproduce** Steps to reproduce the behavior: 1. Find a system that has 10's of thousands of events. One such way is explained on a [Discord thread](https://discord.com/channels/736478043522072608/744281869499105290/1064575875397468271). 2. Remote Background > Event Log 3. Add a search term to query the logs. 4. If necessary, increase the number of days. 5. Tactical will return "400 bad request" and "Unable to contact agent" error messages. **Expected behavior** It would be nice if Tactical handled the situation gracefully. This could be done using pagination for the events, or perform the search on the agent instead of the server (or browser?). A simple solution is to return the first X records with a message that the rest were truncated due to volume. If the error is due to timeout, maybe provide a message that the agent timed out after X seconds. **Screenshots** Here's the error message when showing the last 1 days. It's unclear if it's due to the number of events or a timeout when gathering the events. ![image](https://user-images.githubusercontent.com/7763429/212734409-3183cc07-1086-4964-ba83-ab51c89b8aa3.png) **Additional context** A better error message would help with the troubleshooting effort. As explained in the Discord thread above, querying `Win32_Product` will cause a bunch of "Windows Installer reconfigured the product" messages in the event logs. This is explained in Microsoft's [KB articles](https://learn.microsoft.com/en-us/troubleshoot/windows-server/admin-development/windows-installer-reconfigured-all-applications). The suggestion to use `Win32reg_AddRemovePrograms` is not a perfect replacement as that causes an error. There currently are 3 scripts that use `Win32_Product`.

kerem commented

2026-03-02 02:19:40 +03:00

Author

Owner

@NiceGuyIT commented on GitHub (Jan 16, 2023):

Possibly related NATS errors in the agent.log.

time="2023-01-16T09:21:12-08:00" level=error msg="NATS error: nats: Permissions Violation for Publish to \"_INBOX.**********************.**********************06e0\""
time="2023-01-16T09:21:12-08:00" level=error msg="<nil>\n"
time="2023-01-16T09:21:16-08:00" level=error msg="NATS error: nats: Permissions Violation for Publish to \"_INBOX.**********************.**********************ed6c\""
time="2023-01-16T09:21:16-08:00" level=error msg="<nil>\n"
time="2023-01-16T09:28:14-08:00" level=error msg="NATS error: nats: Permissions Violation for Publish to \"_INBOX.**********************.**********************8c7d\""
time="2023-01-16T09:28:14-08:00" level=error msg="<nil>\n"
time="2023-01-16T09:38:40-08:00" level=error msg="NATS error: nats: Permissions Violation for Publish to \"_INBOX.**********************.**********************90be\""
time="2023-01-16T09:38:40-08:00" level=error msg="<nil>\n"
time="2023-01-16T09:39:00-08:00" level=error msg="NATS error: nats: Permissions Violation for Publish to \"_INBOX.**********************.**********************182a\""
time="2023-01-16T09:39:00-08:00" level=error msg="<nil>\n"

@NiceGuyIT commented on GitHub (Jan 16, 2023): Possibly related NATS errors in the `agent.log`. ```text time="2023-01-16T09:21:12-08:00" level=error msg="NATS error: nats: Permissions Violation for Publish to \"_INBOX.**********************.**********************06e0\"" time="2023-01-16T09:21:12-08:00" level=error msg="<nil>\n" time="2023-01-16T09:21:16-08:00" level=error msg="NATS error: nats: Permissions Violation for Publish to \"_INBOX.**********************.**********************ed6c\"" time="2023-01-16T09:21:16-08:00" level=error msg="<nil>\n" time="2023-01-16T09:28:14-08:00" level=error msg="NATS error: nats: Permissions Violation for Publish to \"_INBOX.**********************.**********************8c7d\"" time="2023-01-16T09:28:14-08:00" level=error msg="<nil>\n" time="2023-01-16T09:38:40-08:00" level=error msg="NATS error: nats: Permissions Violation for Publish to \"_INBOX.**********************.**********************90be\"" time="2023-01-16T09:38:40-08:00" level=error msg="<nil>\n" time="2023-01-16T09:39:00-08:00" level=error msg="NATS error: nats: Permissions Violation for Publish to \"_INBOX.**********************.**********************182a\"" time="2023-01-16T09:39:00-08:00" level=error msg="<nil>\n" ```