we have three servers whose event time is 8 days before the ICDx collected time. Our ICDx server is pulling events from a Symantec DCS Advanced server. All other servers' collected time is within a few seconds of the event time. The three servers that are way behind happen to be rsyslog servers that the ICDx is forwarding to.
Any ideas why these three servers would be so far behind?
Thanks,
Mike
------------------------------
Mike
WaveRider Security
CA
------------------------------