Hello, NetworkNinja
i have had similar problem like you. But the Debug-Function is very helpful to find out where something strange happens ...
There are no "Logfile" the Debug Info will appear by itself in the application eventlog of the w2k3 host.
Possible Problem i have had is, that in security-eventlog are appearing so much entries per second, that the eventloginterpreter cannot finish scan on this log. Only with active debugging info i see hundrets of entries of debuginfos in eventlog per second. So i could determine, that the problem was to excessive security logging in security eventlog.
The reason for notfunctioning of eventlogagent was in my case, that ALL security relevant events was logging in security log - from all over our ads. This was happend through wrong settings in grouppolicy in ADS. After corrective actions in our grouppolicy settings we get a lot of CPU usage back
.I hope this story helps you a little bit.
I know, my english is not very good -- but i hope you understand what i tried to tell you
Greetings from Germany
wollila