Table of Contents
Advertisement
Sentinel Time
Figure A-6
1. By default, the event time is set to Collector Manager time. The ideal time is the device time.
Therefore it is best to set the event time to the device time if the device time is available,
accurate, and properly parsed by the Collector.
2. Events are sorted into 30 second buckets so that they can be viewed in Active Views. By
default, the events that have a timestamp within a 5 minute range from the DAS_RT server time
(in the past or future) are processed normally. Events that have timestamps more than 5 minutes
in the future do not show in the Active Views, but are inserted into the database. Events that
have timestamps more than 5 minutes and less than 24 hours in the past are still shown in the
charts, but are not shown in the event data for that chart. A drill down operation is necessary to
retrieve those events from the database.
3. Correlation reorder buffer. If the event time is more than 30 seconds older than the server time,
the correlation engine does not process the events.
4. If the event time is older than 5 minutes than the Collector Manager time (correct time), events
are directly routed to the database.
A.3.6 System Events
System Events is a means to report on the status and status change of the system. There are three
types of events generated by the internal system, they are:
Internal Events
Performance Events
Audit Events
Sentinel Architecture 449
Advertisement
Table of Contents
