Description
When enabling features at the DC, it is possible to start generating event logs that are too big to fit the FSSO CA buffer for processing and due to this the Collector Agent can miss some user logon events when monitoring method 'Check Windows Security Event Logs' is utilized.
When event record is too big to fit the FSSO CA buffer, it will raise an error called ERROR_INSUFFICIENT_BUFFER and the Collector Agent will skip this record.
Scope
For FSSO Collector Agent.
Solution
Switch the polling method to use the WMI.
For more information about FSSO monitoring methods check related article.
Note.
This behavior is implemented since FSSO 5.0272 (in previous releases the FSSO processing get stuck).
