1 2 Previous Next 13 Replies Latest reply on Jan 20, 2016 6:16 PM by akerr

    Several Hour Delay in Seeing Events

    akerr

      The RTTA and events from the NSM that are fed into our SIEM are delayed by several hours.  Right now, the events coming in to the RTTA and our SIEM (McAfee ESM) are about 4 hours old.

       

      We're running NSM version 8.2.7.x

      It's a bit of a different situation in that the sensors live on a customer network, but the NSM lives in our data center.  The two are connected by a VPN link.  The link is busy, but not overloaded.  I've had a look and there are no dropped packets, or other network errors that I can see, either on the sensor or the manager.

       

      Anyone have any ideas where to start looking?  This has been an issue since we installed it a couple of months ago.

        1 2 Previous Next