Kaseya Community

Delayed emails... (maybe not the correct choice of word)

  • Hi,

    We are currently experiencing delays to get the email notification from Kaseya...

    Example:

    [INDENT]From: no-reply@alerts.htg.co.nz [mailto:no-reply@alerts.htg.co.nz]
    Sent: Thursday, 10 June 2010 10:02 a.m.
    To: msp
    Subject: [serverXYZ.root.clientXYZ] Security log generated Success Audit Event 513 for event set Security - Server Shutting Down

    Security log generated Success Audit Event 513 on dgcbksvr.root.dairygoat
    For more information see http://www.eventid.net/display.asp?eventid=513&source=SECURITY

    Log: Security
    Type: Success Audit
    Event: 513
    Agent Time: 2010-06-10 10:00:21Z
    Event Time: 09:49:22 PM 9-Jun-2010 UTC
    Source: SECURITY
    Category: System Event
    Username: N/A
    Computer: SERVERXYZ
    Description: Windows is shutting down.
    All logon sessions will be terminated by this shutdown.
    [/INDENT]

    I've highlighted in the above the bits that worries me in Bold Red...

    This email notification is coming from the Alerting module of K2 via an Event Set on the Security Event Logs...
    As you probably already noticed it, the email arrived roughly 10 to 12 hours late...

    Now I just noticed one thing about the current settings of the Alarm: this one (like most of the other ones I've set) is supposed to "Alert if this event occurs 1 time(s) within 1 Day, Ignore additional Alarm for 1 Day".

    Is there anything I did wrong here ?
    Could it be the difference of time between UTC and New Zealand ?

    Legacy Forum Name: Delayed emails... (maybe not the correct choice of word),
    Legacy Posted By Username: HTG
  • Agent Time: 2010-06-10 10:00:21Z

    Legacy Forum Name: General Discussion,
    Legacy Posted By Username: ETG
  • ETG
    Agent Time: 2010-06-10 10:00:21Z


    Is there anything I'm supposed to understand here ?

    Legacy Forum Name: General Discussion,
    Legacy Posted By Username: HTG
  • Agent Time: 2010-06-10 10:00:21Z
    Event Time: 09:49:22 PM 9-Jun-2010 UTC

    NZ time is +12 UTC. If you add in 10 minutes for the machine to start back up and then add 12 hours for the time difference, you get the agent time. The server shut down at 09:49:22 AM 10-Jun-2010 NZ time. Which means you got the alert pretty much as soon as it came back up.

    Legacy Forum Name: General Discussion,
    Legacy Posted By Username: alanuhe
  • The date and time is the 10th of June at 10:00:20

    Legacy Forum Name: General Discussion,
    Legacy Posted By Username: ETG
  • Can the UTC time be altered to reflect current time here in NZ?

    Legacy Forum Name: General Discussion,
    Legacy Posted By Username: HTG
  • Look at Agent Time and ignore Event Time. Or, in your case, since it's a 12-hour difference correcting it in your head is easy.

    I've noticed that e-mail alerts show the correct time, though all of our servers are in our time zone so I don't know if there's any quirks with different time zones.

    We see this difference all the time in our logs, and the alerts instant (we sometimes see alerts from within the past minute):

    Agent Time: 15:11:31 14-Jun-10
    Event Time: 21:11:31 14-Jun-10 UTC


    You *could* disable the server's nntp client, set the time zone to UTC, and adjust the clock back, but that's going to give you a much bigger headache when other things stop working. Stick to the Agent Time, since that tells you the local time on the alarmed machine.

    Legacy Forum Name: General Discussion,
    Legacy Posted By Username: dwujcik