When querying the Symantec Messaging Gateway Message Audit Logs (MAL) via the Control Center Status -> Message Audit Logs page, new messages do not appear in the "past hour" or "past day" queries until after some delay has passed.
This is usually the result of a loss of clock synchronization between the control center appliance and the scanner appliance.
MAL queries are made using times relative to the control center appliance system clock. If the scanner appliance system clock leads the control center system clock by a significant amount then MAL queries will not return the expected result until the control center appliance system clock catches up to what the scanner appliance has recorded in the audit log.
Please ensure that the system clocks for all scanner and control center appliances are synchronized to ensure accurate audit logging of message traffic.
To use NTP time syncronization please follow the procedure below:
The second step ensures that the clocks will immediately be synchronized in the event that they are more than an hour off from the NTP server time source.