symatec sep11 duplicate alert
we are cnnected to sep 11 DB with arcsight collector in 4 domains,4 servers eche server with is DB .
we suffer from weird Problem -
1 .we get event on virus .
2.after a week or 8 days we get the sam event with the same parameters (differnt eventID in arcsight )
3.we canot see this event in symantec console ,or symantec DB .
4.we run arcsight query on the DB for test and still didnt see the event.
did any one bump into this problem?