I had this issue when my Event Collector became overloaded because of too many alerts per second (I believe the max is 500). Look for EC warnings that mention throttling.
If that's the issue you'll need to add another EC or lessen your alerts.
Hope this helps.
--
Marc Soda, CISSP
Information Security Engineer
NCO Group
215.441.2127
[EMAIL PROTECTED]
-----Original Message-----
From: Ayden Nash [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, January 27, 2004 7:49 PM
To: [EMAIL PROTECTED]
Subject: [ISSForum] False data and time for events
Hi all,
Alerts seen in siteprotector all have wrong date/time's associated with them, even though the operating systems they
run on have the correct time. Is seems the run time's of sensor updates etc. are ~9 hours behind. Where are these false times
coming from?
Thanks,
Ayden
_______________________________________________
ISSForum mailing list
[EMAIL PROTECTED]
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo
