驱动器填满后未处理的异常错误 [英] Unhandled exception error after drive filled

问题描述

我们的Log Integration Server C：\\驱动器已满。通过删除重新启动的旧的azlog文件来清理服务器之后。现在，当尝试以管理员身份运行任何"azlog"命令时，将抛出以下异常：
 
未处理的异常：System.NullReferenceException：未将对象引用设置为对象的实例。 
在AZ中的AZLOG.Config.ServiceState.Load（）中：\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ \\ _ZSIEMDll \\Config.cs：第61行
在AZ中的AZLOG.Program.RealMain（String [] args，Boolean& runTrackPageView）E：\\\\\\\\\\\\\\\\\\\\\\\\ \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ $ b我还注意到C：\\Users\\azlog\\azlog.10.config.ServiceState文件为空
 
结果我们的Active Directory，资源中心，和安全中心日志没有写入C：目录并进入Splunk。 
请告知如何备份并尽快运行。

解决方案

您好romsdn，请注意日志集成服务将于6/1/2019弃用。请访问此处查看建议的
。如果您没有支持计划，请发送邮件至[e-mail]，包括您的订阅ID以及指向此MSDN主题的链接，我们很乐意协助您提供支持。

<希望这会有所帮助。

干杯。

Our Log Integration Server C:\\ drive filled up. After cleanup the server by removing older azlog files it was restarted.  Now when attempting to run any 'azlog' commands as administrator, the following exception is thrown:

Unhandled Exception: System.NullReferenceException: Object reference not set to an instance of an object.
   at AZLOG.Config.ServiceState.Load() in E:\\bt\\810407\\repo\\src\\AZSIEMExport\\AZSIEM\\AZSIEMDll\\Config.cs:line 61
   at AZLOG.Program.RealMain(String[] args, Boolean& runTrackPageView) in E:\\bt\\810407\\repo\\src\\AZSIEMExport\\AZSIEM\\AZSIEM\\AZLOG.cs:line 282
   at AZLOG.Program.Main(String[] args) in E:\\bt\\810407\\repo\\src\\AZSIEMExport\\AZSIEM\\AZSIEM\\AZLOG.cs:line 222

I also noticed the C:\\Users\\azlog\\azlog.10.config.ServiceState file is empty

As a result our Active Directory, Resource Center, and Security Center logs are not being written to C: directories and getting into Splunk.
Please advise on how to get this back up and running asap.

解决方案

Hello romsdn, Please note that Log Integration service will be deprecated by 6/1/2019. Please visit here to review suggested replacement for Log integration. 

First off, can you elaborate on the specific steps you took to perform the "cleanup"? Did you perform a hard delete or did you simply move the logs to another drive or repository? Also was the cleanup performed on one or multiple Log integration servers or is this an isolated incident? If multiple, are you experiencing the same issues on your other servers. If you deleted, then you may have inadvertently deleted some critical service state files. You may want to consider rolling back the cleanup assuming it wasn't a permanent deletion and see if that resolves your issue. You may also want to move the log location to a non-OS drive to prevent future occurrence - if possible.

If this is a service-impacting incident, then I strongly recommend engaging the Azure technical support team to deep dive further. You can engage them using these steps. If you do not have a support plan, send mail to [e-mail], include your subscription ID and a link to this MSDN thread for context and we will gladly assist you with engaging support.

Hope this helps.

Cheers.

这篇关于驱动器填满后未处理的异常错误的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！