I came across this in a driver today and find it extremely irritating. In my
understanding, value nodes in subscriber events have @timestamp, which is CTIME
format and gives the time when a value has been added to an object (or cached
by IDM, not sure about that). When converted to human readable formats it
usually matches the value timestamp as seen in iMonitor. Now look at this event:

[09/19/17 17:41:07.671]:AIE-SyncEngine ST:Start transaction.
[09/19/17 17:41:07.675]:AIE-SyncEngine ST:Processing events for transaction.
[09/19/17 17:41:07.677]:AIE-SyncEngine ST:
<nds dtdversion="4.0" ndsversion="8.x">
<source>
<product edition="Advanced" version="4.5.6.0">DirXML</product>
<contact>NetIQ Corporation</contact>
</source>
<input>
<modify cached-time="20170919154107.586Z" class-name="Group"
event-id="idv45#20170919154107#1#1:76438ee7-8687-4021-99ab-e78e43768786"
qualified-src-dn="O=data\OU=groups\CN=ch
ildGroup" src-dn="\DEV-TREE-45\data\groups\childGroup" src-entry-id="40542"
timestamp="1645629529#57173">
<modify-attr attr-name="Description">
<add-value>
<value timestamp="1645629529#57173" type="string">test</value>
</add-value>
</modify-attr>
</modify>
</input>
</nds>

Trace timestamps as well as @cached-time and @event-id have today's date, about
an hour ago when I tested this again. @timestamp on the event and on the value
node match, but are a little over 5 years in the future! This is SLES11SP4 VM,
Edir 88810HF1, IDM 456, all patched, single server, no replication, time is in
sync with reality, machine has been rebooted only a few hours ago:

idv45:/var/log/idm # date
Tue Sep 19 18:36:22 CEST 2017

idv45:/var/log/idm # hwclock
Tue Sep 19 18:36:27 2017 -0.677548 seconds

idv45:/var/log/idm # ndsrepair -T

[1] Instance at /etc/opt/novell/eDirectory/conf/nds.conf:
idv45.OU=servers.O=system.DEV-TREE-45
Repair utility for NetIQ eDirectory 8.8 - 8.8 SP8 v20811.03
DS Version 20811.09 Tree name: DEV-TREE-45
Server name: .idv45.servers.system

Size of /var/opt/novell/eDirectory/log/ndsrepair.log = 1329 bytes.

Building server list
Please Wait...
Preparing Log File "/var/opt/novell/eDirectory/log/ndsrepair.log"
Please Wait...
Collecting time synchronization and server status
Time synchronization and server status information
Start: Tuesday, September 19, 2017 18:36:34 Local Time

---------------------------+---------+---------+-----------+--------+-------
DS Replica Time Time is Time
Server name Version Depth Source in sync +/-
---------------------------+---------+---------+-----------+--------+-------
Processing server: .idv45.servers.system
..idv45.servers.system 20811.09 0 Non-NetWare Yes 0
---------------------------+---------+---------+-----------+--------+-------
Total errors: 0
NDSRepair process completed.

Any idea what could be causing this? Is that 5-digit "#57173" related? Usually
I see single or double digits there.

Would be a nightmare if we could not trust value/@timestamp anymore...

Oh, iMonitor has:

Description
02/23/22 04:18:49 PM 1:57173 Present test



--
http://www.is4it.de/en/solution/iden...ss-management/

(If you find this post helpful, please click on the star below.)