Message audit log queries do not show recent messages until after some time has passed
search cancel

Message audit log queries do not show recent messages until after some time has passed

book

Article ID: 154155

calendar_today

Updated On:

Products

Messaging Gateway

Issue/Introduction

When querying the Symantec Messaging Gateway Message Audit Logs (MAL) via the Control Center Status -> Message Audit Logs page, new messages do not appear in the "past hour" or "past day" queries until after some delay has passed. 

Cause

This is usually the result of a loss of clock synchronization between the control center appliance and the scanner appliance.

MAL queries are made using times relative to the control center appliance system clock. If the scanner appliance system clock leads the control center system clock by a significant amount then MAL queries will not return the expected result until the control center appliance system clock catches up to what the scanner appliance has recorded in the audit log.  

Resolution

Please ensure that the system clocks for all scanner and control center appliances are synchronized to ensure accurate audit logging of message traffic.

To use NTP time syncronization please follow the procedure below:

  1. Log into the control center as an administrator
  2. From the Administration->Configuration->host->DNS/Time page set the date and time manually to the nearest minute and click "Save".
  3. Then, from the same page, select the "Use NTP servers" option, enter a list of available NTP servers and clock "Save".

The second step ensures that the clocks will immediately be synchronized in the event that they are more than an hour off from the NTP server time source.