Article ID: 909131
Article Last Modified on 11/15/2007
APPLIES TO
- Microsoft Software Update Services 1.0
SYMPTOMS
Client computers do not report back to the Microsoft Windows Software Update Services (WSUS) server. Additionally, the following symptoms may occur:
- The following error message is logged in the Windowsupdate.log log file on client computers:
- Microsoft SQL Server time-out error messages are displayed in the administrative console on the WSUS server.
- The SoftwareDistribution.log file that is located in the %programfiles%\Microsoft Windows Update Services\LogFiles folder contains messages that are similar to the following:
CAUSE
This problem occurs if the number of reporting events in the tbEventInstance table exceeds 1 million rows.
A WSUS server that is using the recommended hardware can support a maximum number of 15,000 clients by using a default detection cycle of 22 hours. The number of reporting events that is added to the tbEventInstance table depends on the number of clients and on the frequency that is set for each detection cycle. Automatic deletion of rows from the tbEventInstance table starts when a client tries to send a report. The automatic deletion process is initiated only if the reporting events in the tbEventInstance table exceed 1 million rows.
The automatic deletion process is very slow and blocks the client computers from reporting back to the WSUS server. By default, WSUS is configured to delete events that are older than 15 days on workstations and that are older than 90 days on servers. WSUS deletes old events at the rate of 1,000 events every 12 hours.
For information about how to determine whether the tbEventInstance table has exceeded 1 million rows, see the "More Information" section.
RESOLUTION
Hotfix information
A supported hotfix is now available from Microsoft. However, this hotfix is intended to correct only the problem that this article describes. Apply this hotfix only to systems that are experiencing this specific problem.
To resolve this problem, submit a request to Microsoft Online Customer Services to obtain the hotfix. To submit an online request to obtain the hotfix, visit the following Microsoft Web site:
Note If additional issues occur or any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. To create a separate service request, visit the following Microsoft Web site:
Prerequisites
No prerequisites are required.
Restart requirement
You do not have to restart the computer after you apply this hotfix.
Hotfix replacement information
This hotfix does not replace any other hotfixes.
File information
The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.
| File name | File version | File size | Date | Time | Platform |
|---|---|---|---|---|---|
| Eventinstancesfix.dll | Not Applicable | 41,272 | 07-Nov-2005 | 11:36 | x86 |
| Eventinstancesfix.sql | Not Applicable | 14,442 | 01-Nov-2005 | 10:42 | Not Applicable |
| Runeventinstancesfix.vbs | Not Applicable | 1,433 | 08-Nov-2005 | 12:16 | Not Applicable |
WORKAROUND
To work around this issue, change the detection cycle to a value that is in the allowed range. By using Group Policy, you can manipulate the time between each detection cycle from 1 hour to 22 hours. For example, if you change the detection cycle frequency from the default 22 hours to 11 hours, the number of clients that the WSUS server can support is reduced to 7,500 clients.
If client computers do not report back to the WSUS server after you change the detection cycle frequency, you must delete all the current events from the tbEventInstance table. To do this, run the following command in SQL Query Analyzer:
TRUNCATE TABLE dbo.tbEventInstance
Additionally, you can stop the automatic deletion process and then increase the frequency of the deletion process. After you increase the frequency of the deletion process, WSUS deletes rows in smaller chunks, but maintains the size of the tbEventInstance table.
To stop the automatic deletion process and to set the frequency of the deletion process to 1 hour, run the following command in SQL Query Analyzer:
UPDATE dbo.tbConfigurationB SET AutoPurgeDetectionPeriod = 1
This command runs the deletion process every hour. After you run this command, WSUS deletes 24,000 events per day at the rate of 1,000 events per hour. This is the highest frequency that can be set for the deletion process.
To calculate the correct automatic deletion frequency and the correct detection cycle frequency, you must know the number of WSUS clients.
Use the following formulas to calculate the minimum frequency for the deletion process and the detection cycle frequency:
Minimum deletion process frequency: (24/DF) x CL
Detection cycle frequency: (CL/PF) x 24
Note DF is the detection cycle frequency, CL is the number of WSUS clients, and PF is the minimum purge frequency.
For example, if there are 4,000 WSUS clients and if you set the detection cycle frequency to 8 cycles per day, approximately 32,000 events can be logged to the tbEventInstance table. The maximum number of events that can be removed by the deletion process per day is 24,000 events when you set the deletion frequency to 1 hour. Therefore, you can reduce the detection cycle frequency so that the number of events that are generated by the clients is less than 24,000.
STATUS
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.
MORE INFORMATION
How to determine whether the tbEventInstance table has exceeded 1 million rows
- Start SQL Query Analyzer, and then connect to the local server.
- In the Databases list, click SUSDB.
- Paste the following SQL query in the Query window:
select count(*) from tbEventInstance
- Click Execute Query to run the query.
If you are running Microsoft SQL Server Desktop Engine (Windows) (WMSDE), you can also use the osql command to verify whether the tbEventInstance table has exceeded 1 million rows. To do this, type the following command at a command prompt, and then press ENTER:
"%programfiles%\Update Services\tools\osql\osql.exe" -S %COMPUTERNAME%\WSUS -E -dSUSDB -Q"SELECT COUNT(*) FROM dbo.tbEventInstance"
For more information, click the following article number to view the article in the Microsoft Knowledge Base:
824684 Description of the standard terminology that is used to describe Microsoft software updates
Keywords: kbtshoot kbbug kbfix kbqfe kbpubtypekc kbhotfixserver KB909131
