Hi All
My customer response me about he query event seem not match with
original server log files (like /etc/message), I check the both server
ntp setting and date fine. and event seem received well (I only see
crond event recevied).
After I check much times from event source object and check raw date
from it ..I find these observe_event_time of crond event is one month
yet!!! Yes, the date is one month ago.
I try to restart connector and the Connector and Collector (the sentinel
service does not restart), the observe_event_time immediately sync now.
Because I check observe_event_time from EventSource object . not from
connector or Collector object....so these events that I see could be not
parseed...but what the time delay that one month ago.

Who has similar experience like me ? need upgrade connector or collector


wyldkao's Profile: https://forums.netiq.com/member.php?userid=1688
View this thread: https://forums.netiq.com/showthread.php?t=52893