ntevl probe crashes with putting any text inside field

Document ID : KB000123213
Last Modified Date : 19/12/2018
Show Technical Document Details
Issue:
ntevl probe v4.32 will not remain running and throws a max restarts error in the log.

Dec 19 14:34:40:277 [5368] ntevl: ****************[ Starting ]**************** 
Dec 19 14:34:40:277 [5368] ntevl: * Windows NT event log watcher 4.32 
Dec 19 14:34:40:277 [5368] ntevl: * Nimsoft Corporation 
Dec 19 14:34:40:277 [5368] ntevl: port=48010 PID=3056 
Dec 19 14:34:40:277 [5368] ntevl: Initial log file positions: 
Dec 19 14:34:40:277 [5368] ntevl: Application = 2981 
Dec 19 14:34:40:277 [5368] ntevl: System = 8288 
Dec 19 14:34:41:730 [5452] Controller: Max. restarts reached for probe 'ntevl' (command = ntevl.exe) 
Environment:
-UIM v9.02
- ntevl v4.32
Cause:
The problem occurred when we try to free dynamic memory being allocated by function pcre_compile (pre-compile regex library). As this function is getting called at the time of initialization of probe, the probe crashes immediately after a restart. 

As of now, we commented out the code which was causing problems, as the code is being called only at the time of initialization, it will have no impact on probe performance and will work as expected.
Resolution:
Download the ntevl v4.32 HF1 version from:

https://support.ca.com/us/product-content/recommended-reading/technical-document-index/ca-unified-infrastructure-management-hotfix-index.html

ntevl-4.32-HF1.zip