Delayed Event Log Events

[Crocker]

I've noticed over the past couple of days, when looking at the Event Log for some of our MX's, that there is a large delay in events appearing in the log. As an example, I'm looking at a network right now (local time 11:48AM CST) whose last event log entry was 8:30:31 AM; I know there's been plenty of events since then.

Has anyone else noticed this?

[Mloraditch]

There is generally a small lag, but I've not seen nor do I see at quick glance anything like that for me right now. Have you verified that the time zone of the network matches your PC? That would explain some discrepancy.

If it does match, do relevant logs for the missing time show up eventually? My only suggestions to resolve would be reboots followed by support. Perhaps a firmware update if you lagging there.

[rhbirkelund]

Have you configured the network to the correct timezone?

Looking at the eventlog, in the Time column, you can see the timezone, in a light grey color.

You could also go to Network-Wide -> Configure -> General, and verify what timezone has been configured for the network.

[Crocker]

Yep, time zone is configured correctly at the locations I've noticed this at. I'm in the same timezone as them, as well.

[rhbirkelund]

Is there by any chance an "Events Dropped" event?

This usually indicates that there's been a burst of the preceeding event.

[BlakeRichardson]

Events dropped are a pain, the whole point of logging is to capture whats happening. 

[rhbirkelund]

Oh, I agree.

[RWelch]

Are you sure you are on "security appliance?"  Are there any filters set that might need to be cleared?

[DarrenOC]

Syslog, syslog, syslog……