i have the problem with my 3 Receiver Cluster if i do a fail over from one ofthe Cluster than the Secondary Reveiver do the work so no Problem at this side. But If the secondary Receiver is updated to primary Receiver we get old Events from the now Primary.
At this time this was more than 400 old Alarms.
Does have any one of you the same Problem and a Solution?
Is this connected only with passive sources (for example syslog) or active (wmi, ff etc)?
if active, try to proceed second failover over the 5 minutes - becouse of 5min sync bookmarks between both ERC's (if you change sec to prim before the sync of bookmarks you will get events that you might already have...)