ESA Alerts Graph shows Unevenly

[pranavsankar1]

Hi All,

According to our SA setup we have two locations say A and B(Recovery). The Alerts in location A gave the same output with location B with small-scale time difference say 5-10 mts. But when i checked in both locations the ESA Alerts graph shows unevenly. What could be the possible reasons and what all ways i can troubleshoot the same??

Thanks in advance

Pranav

[DavidWaugh1]

Hi could you post a screenshot of the graphs from both sites so we can compare.

I would check that the times on all systems are in synched to the same NTP source.

[pranavsankar1]

Hi Dave ,

I have taken the time stamps for both graphs as half an hour.Eventhough i can see slightly difference for both.

PFB screen shot.

Location  A

Location B

[DavidWaugh1]

Have you got exactly the same rules deployed on both system?

Are the same concentrators feeding into to both systems?

[pranavsankar1]

Yes dave for different locations we have deployed same rules only .

Nope we have different concentrators feeding for both locations.

[DavidWaugh1]

I would check in investigator that the same traffic is going through both concentrators. Different traffic is going to produce different results in ESA.