...
Look at your interface log file(s) from a time when multiple NLINK Sessions are posting to the same log file. If you notice that messages from each session are a second or more apart when they should logically be happening much closer together, this is a symptom. (Normally many messages could be logged within a single second, even from multiple sessions.)
| Code Block | ||
|---|---|---|
| ||
07-Mar-19 11:33:41 [Session Id 0] [Interface - FOO_BAR] [INFO] got one
07-Mar-19 11:33:42 [Session Id 1] [Interface - FOO_BAR] [INFO] got one
07-Mar-19 11:33:43 [Session Id 2] [Interface - FOO_BAR] [INFO] got one
07-Mar-19 11:33:44 [Session Id 3] [Interface - FOO_BAR] [INFO] got one
07-Mar-19 11:33:45 [Session Id 4] [Interface - FOO_BAR] [INFO] got one
07-Mar-19 11:33:46 [Session Id 5] [Interface - FOO_BAR] [INFO] got one
07-Mar-19 11:33:47 [Session Id 6] [Interface - FOO_BAR] [INFO] got one |
Look at the Inbound Message Queue in the NLINK Management Module (NMM) while multiple NLINK sessions are working on the Events for the same interface. If you notice that the Current Action for the active Events is frequenly a Log Message Action, this is a symptom. (Normally a Log Message should be so quick that it rarely shows up as the Current Action.)
(Note that the entries here show the description of the Action as configured, so you may not see the exact words Log Message.)
Solution
As an example, the following steps describe how to add a Folder Exclusion Rule for the Logs folder and a Process Exclusion Rule for the NLINK Server in Windows Defender on a Windows 2016 Server.
...