KBI 311142 Issue Addressed: File Log Lines Are Not Read When File Server Time Is Out Of Sync And Ignore Minutes Are Too Small

Version

Argent Advanced Technology all versions

Date

Wednesday, 31 Dec 2014

Summary

Argent for Compliance can monitor and/or Archive Events in log files reside on remote file server

The file server time may be out of sync with Argent AT Engine

It is quite common if the file server is UNIX/Linux machines

It is less common for Windows machines as Windows machine time usually is synchronized with Windows Domain Controller

If File Server Time is late compared to Argent AT Engine, and the late minutes is larger than the ignore minutes in File Rule Log, Argent AT Engine will ignore the log file even the log file is constantly updated

It is because the Argent AT Engine decides no need to read the log file as Events will be ignored anyway

Technical Background

Argent AT Engine does not read from beginning of log file each time

Instead, it keeps the Last Read Event Time, and restart scanning from where it was left last time

As a result, setting a larger ignore minutes will not cause duplicate Events to be read or alerted

Resolution

Set the ignore minutes in the Rule to one day or a number at least twice of time difference between file server and Argent AT Engine