I might start be ensuring that they are being sent succecssfully. Use the EICAR test string to verify your workstation can generate an event (look for the XML file). Then watch that folder when you use the "Send Events" function of the Agent's Status Monitor. If the XML file is generated and disappears (gets uploaded), then you can likely rule out any client-side problems.
Then, I would take a look at the Events folders on each Agent Handler and the ePO server. You should see files cycling through as they are processed. I would probably also check the Event Parser services on any/all Agent Handlers and the ePO server itself. Restart then, just for giggles.
Lastly, review anything related to the database. Maybe the table is full or the data file isn't set to grow. I suppose there could also be problems with purging tasks or the Event Filtering configuration that would limit this data.
Take a stab at a few of these and let us know what you find!
I tested sending an event as you described. Works like a charm.
The only Agent Handler we have is the server itself. I looked at the folder. The events in that folder are processed but when I take al look at the DEBUG folder, there are 24.000+ events! So I found them! Now I have to find a way to let ePO process them.
With a quick internet search I found the following remark: "Events with an outdated or not installed Reports Extension will store the not parsed Event in DB\Events\DEBUG."
So I have to find out what is wrong with the reports extension... Or are the other possibilities for this behavour?
In turns out the Reports Extension was missing....
And its clear why...
I removed VSE 8.7 from the Software manager. That, apparantly, uninstalls the Reports Extension from VSE 8.8.
I checked in VSE8.8 Reports Extension again and now I'm also the owner of Reports Extension VSE 8.7 again?!?!?! Strange?
I processed the events now. Turns out there were some very old Exchange events waiting in the debug folder.
Message was edited by: sushi78 on 11/8/13 2:19:08 AM CST
Anything that the parser has trouble dealing with will land in that DEBUG folder. You can try to move them from their, back into the parent folder maybe a thousand at a time. If there is still a parsing problem, they will land in the debug again.
Hopefully, this will get you all (or at least most) of your missing data.