When querying the Symantec Messaging Gateway Message Audit Logs (MAL) via the Control Center Status -> Message Audit Logs page, new messages do not appear in the "past hour" or "past day" queries until after some delay has passed.
This is usually the result of a loss of clock synchronization between the control center appliance and the scanner appliance.
MAL queries are made using times relative to the control center appliance system clock. If the scanner appliance system clock leads the control center system clock by a significant amount then MAL queries will not return the expected result until the control center appliance system clock catches up to what the scanner appliance has recorded in the audit log.
Please ensure that the system clocks for all scanner and control center appliances are synchronized to ensure accurate audit logging of message traffic.
To use NTP time syncronization please follow the procedure below:
Log into the control center as an administrator
From the Administration->Configuration->host->DNS/Time page set the date and time manually to the nearest minute and click "Save".
Then, from the same page, select the "Use NTP servers" option, enter a list of available NTP servers and clock "Save".
The second step ensures that the clocks will immediately be synchronized in the event that they are more than an hour off from the NTP server time source.
Imported Document ID: TECH158309
Subscribing will provide email updates when this Article is updated. Login is required.