Anonymous_User Absent Member.
Absent Member.

Managing events from mobile computers running AM agent

Running NetIQ AM 8.2 with agents at the same level. For my laptops,
after being off for a long time, after they come back online I get a
SLEW of events which all indicate the current time; rather the original
time the event actually occurred which may have been hours, days, or
weeks ago (Except for the Event Log KS, as it wraps up all the old
events into one message but you can see the date/time stamps of the
individual events within the messages but not so for all the other
KS'es. Any way I can better manage this? :eek:

toddheron's Profile: https://forums.netiq.com/member.php?userid=11298
View this thread: https://forums.netiq.com/showthread.php?t=55803

3 Replies
Anonymous_User Absent Member.
Absent Member.

Re: Managing events from mobile computers running AM agent


It appears that in the past few days you have not received a response to your
posting. That concerns us, and has triggered this automated reply.

These forums are peer-to-peer, best effort, volunteer run and that if your issue
is urgent or not getting a response, you might try one of the following options:

- Visit http://www.netiq.com/support and search the knowledgebase and/or check
all the other self support options and support programs available.
- Open a service request: https://www.netiq.com/support
- You could also try posting your message again. Make sure it is posted in the
correct newsgroup. (http://forums.netiq.com)

Be sure to read the forum FAQ about what to expect in the way of responses:

Sometimes this automatic posting will alert someone that can respond.

If this is a reply to a duplicate posting or otherwise posted in error, please
ignore and accept our apologies and rest assured we will issue a stern reprimand
to our posting bot.

Good luck!

Your NetIQ Forums Team

Micro Focus Frequent Contributor
Micro Focus Frequent Contributor

Re: Managing events from mobile computers running AM agent

Hello Todd,

Every event has a time stamp. If you will double-click any event, you can see the first occurrence time of the event. If you wanted to check the time stamp of each event then you need to unselect the option "collapsed duplicate event into one" option from the advance tab.
Do let me know if this helps.
andy_doran Absent Member.
Absent Member.

Re: Managing events from mobile computers running AM agent

What should be happening here is that whilst the agent is unable to communicate with the MS, any data or event generated is stored in the Local Repository - and gets a GMT timestamp for the time it was created.

Then when the agent can talk to the MS, anything that it cached in the LR is uploaded at that time.

When these events and data arrive in the QDB, they have the timestamp that matches the time they were generated. So Events will set the FirstOccurTime (in the EventDetail table for new events) and LastOccurTime (Event table) based on the time the event was generated. The ModificationTime (Event table) will be the time the event arrived at the QDB (or when something subsequently changed a property of the event...)

The UI does not show the mod time. It can show the time that that the event happened, adjusted for the timezone of the agent or of the console (ie it may have happened on a server in the US and your console is in the UK so you can choose which adjustment you want).

So... you should NOT see events have the time of "now" in the situation you describe.... You will see a slew of events, but each event should have the time of the occurrence rather than the time of arrival in the QDB.

Maybe best to talk to TS to see what is happening here if the UI is showing you the ModificationTime

Also... might be better for lap tops to set them into maintenance mode before taking them away from where they can see the MS... Then you won;t get the events at all (unless you actually want that)
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.