Failed to process keystroke log file, failed to read I/O log info record (4370432)

Failed to process keystroke log file, failed to read I/O log info record

Running "systemctl status pmserviced.service" displays messages such as the following on a policy server:

pmmasterd7.2.2.9 Failed to process keystroke log file: /var/opt/quest/qpm4u/quarantine/<client name>
pmmasterd7.2.2.9 Invalid start record
pmmasterd7.2.2.9 failed to read I/O log info record
pmmasterd7.2.2.9 Failed to process keystroke log file: /var/opt/quest/qpm4u/quarantine

These messages can indicate a corrupted or truncated offline event log on a client system that pmlogxfer continually tries to send to the policy server but always fails.

 

The corrupted file(s) on the client system can be moved or deleted to clear the messages.

Example location and file name on a client system:
/var/opt/quest/qpm4u/offline/event_logs/eventlog.0496ca0761392f

A trace of pmlogxfer run on the client will show the issue like this:

unable to transmit offline log (ev: eventlog.0496ca0761392f io: none)

Trace capture instructions:

/opt/quest/sbin/pmlogxfer -z on
The trace file to upload will be /tmp/pmlogxfer.trc
/opt/quest/sbin/pmlogxfer -z off

Change request 405557 has been raised to improve pmlogxfer's handling of corrupt or truncated log files in a future release.
As of this writing, March 3rd 2023 there is no ETA.

 

405557