I'm looking at a report I've made which shows the "unhandled events" for our domain. Many of the events shown on this report are 1059 events, which is "scan timed out". (I know that many users here turn "off" the logging of 1059 events, but I want to see them, so I can see if clients have consistent problems.)
Anyway, one field in this report is the "Event Generated Time", which of course is in UTC. The time for most of these events shows as about 5:30pm - 9:30pm UTC, which translates to about 9:30am - 1:30 pm for our local time.
However, this group of clients has a Client Task for a nightly scan to start at 1am local time, randomized over 2 hours.
How can a scan which starts at 1-3am, run for 8-12 hours on a particular machine? Or am I misunderstanding what the report is showing?