8 Replies Latest reply on Dec 14, 2010 9:16 PM by frostbitten

    ePO already scanning the future

    serc09

      Hey,

       

      using ePO 4.5 and all seems working fine.

       

      But 20 minutes ago i saw that new recognised threats are beeing managed by the server to be in the future - sounds crazy but look the picture.

       

      Anyone any ideas?

       

      Regards

       

      serc09

        • 1. Re: ePO already scanning the future
          tonyb99

          I used to get this all the time as someone had set a pc 6 months in the future, the event generated time for the malware event is the one from the local workstation if its set ahead then the event comes out ahead.

          • 2. Re: ePO already scanning the future
            serc09

            Both clients have the date of today and time is also right - checked on the machines locally.

             

            Attached 2 pictures.

             

            serc09

            • 3. Re: ePO already scanning the future
              tonyb99

              thats a new one then

              is it only in that custom report? if you recreate it does it still happen?

              • 4. Re: ePO already scanning the future
                serc09

                Custom report?

                Recreate?

                • 5. Re: ePO already scanning the future

                  I would think that once those specific event records are in the ePO database, they will continue to show up with the future date.  If the local systems have the correct date now, newly added events should also have the correct date.  Are you getting new events from those systems that list the correct date?

                   

                  You may be able to delete those records with the incorrect date, or edit them to show the date when they first appeared.  You may have to do it from SQL Server Management Studio instead of from ePO.

                   

                  Jay

                  • 6. Re: ePO already scanning the future
                    serc09

                    jguenrdc schrieb:

                     

                    I would think that once those specific event records are in the ePO database, they will continue to show up with the future date.  If the local systems have the correct date now, newly added events should also have the correct date.  Are you getting new events from those systems that list the correct date?

                    new generated events still appear one week in the future - all dates and times are set correct!

                     

                    You may be able to delete those records with the incorrect date, or edit them to show the date when they first appeared.  You may have to do it from SQL Server Management Studio instead of from ePO.

                    how to do that? I have no idea of how to do that - using the SQL-Server coming with the ePO install (ms sql 2005 express?!)

                     

                    Jay

                     

                    regards

                     

                    serc09

                     

                     

                    on 08.02.10 08:12:00 GMT+01:00
                    • 7. Re: ePO already scanning the future
                      JoeBidgood

                      Please open a case with Support and ask for it to be escalated to Tier 3 - I have a couple of cases open with engineering at the moment for this problem, which is caused by the way that SQL reports the week part of the event's timestamp.

                       

                      Regards -

                       

                      Joe

                      • 8. Re: ePO already scanning the future

                        Was there ever a fix for this issue? I have had a couple of my coworkers bring this issue to my attention recently about a system that has reported events with a timestamp in the future but the times on the offending systems is accurate.