NWE Agent log retrieving delay

[St_Denys]

Hello,

we have a problem with the large delays (up to days) with log  retrieving with the Windows NWE Agent.

It happens with a lot (500+) Windows VMs running in VMWAre. 

When reviewing the event se the big difference between this time stamps

AgentTime=2024-01-19T07:26:10.1991870Z TimeCreatedSystemTime=2024-01-17T23:03:30.3970763Z

What's is the meaning of this fields?

TimeCreatedSystemTime - is when the log entry was records by EventLog?

AgentTime - is when the Agent has read this log entry?

If it is, that could be the cause?

Suspending disc operation problem, CPU overload, put the client's PROD is not confirming any  issues with the infra.

We have open the ticket to the  RSA Support, but still not have resolution.

Thank you.

[JohnKisner · Accepted solution]

Hello St_Denys,

Based on what you are seeing the TimeCreatedSystemTime is the time that is in the event log, as you suspected. The AgentTime is the time the agent picked up the log for distribution back to NetWitness. Does it look like all of your agents are taking about 2 days for the agent to send the log or is it only a few servers within the customer's environment? You'll need to use NetWitness to inspect the incoming logs and look at the TimeCreatedSystemTime to make that determination. It is possible that the servers that the agents are on may be under powered, very busy, or both. Thus there is a large backlog for the agent to get through and thus causing a 2 day delay. You can also see this if the agent starts to catch up during non-business hours. It would be good to know if this is isolated to a few servers or all of them.

[St_Denys]

Hello John, 

Thank you for reply.

The delays problem is observed over the large amount of the agents, about 1000+ machines. I agree that is most probably the client-side problem, but I need the firm response from the vendor to have the arguments agains the Production.  I hope we will have it today after the meeting with the engineering team.

Cheers.

Denys