1 Reply Latest reply on Oct 10, 2013 11:47 AM by siemple

    Incorrect values - Local Receiver




      Home this topic of discussion by the following problem:


      I have a state in the red flag when I see why, it shows me the following:



      "Event retrieved contained possibly incorrect values" I dont understand, this error, can help me?

      I searched in kc. but I found no solution for it I go to the forum


      Thanks for the help.



        • 1. Re: Incorrect values - Local Receiver

          This could be an issue of the data source configuration in the SIEM being set to the wrong time when compared to the syslog messages from the actual device.  You will need to identify the data source on the ESM that is reporting this error, and check the time zone setting.  Then look at the events, and examine what the actual packet shows as the time of the message.  Validate that the time zone setting matches the source setting.


          I have a current issue where VM servers are configured to local time, the data sources in SIEM are configured to the same time, but the data source rule is parsing out the offset time in the packet, instead of the proper message header time.  If you have this issue, you can make the errors go away by changing the data source time zone to match the offset (in my case it would be set to GMT).