Hi everybody,
today we found following strange behaviour. On a box running Windows Server 2003 R2 we have three events:
Two events from SystemLog, Source: NtServicePack, Eventid 4377. Timestamps: 29.08.2013 20:47:21 and
29.08.2013 20:47:34.
There is a third event in Applicationlog, Source: TSM-sysbkp, EventId 990, Timestamp: 29.08.2013 20:47:15
This is an event we create from out of a scheduled script.
All events are targeted with Alert Rules.
The Alerts from Source "NtServicePack" have the CreationTime Property set to the Eventlog's Timestamp.
But the Alert from Source "TSM-sybkp" has a CreationTime Property of 29.08.2013 20.47.39 and an Alert Context showing the correct time of 29.08.2013 20:47:15.
When sorting the Alert View by CreationTime we wondered about the unusual sequence of events.
The process is designed to write the TSM-sysbkp Event when databackups are okay and then starts to install Security Updates.
The timestamps in the EventLogs show this seuqence, but the Alert's CreationTime doesn't.
My question is: Why is there the difference between EventLogs timestamp and the Alert's CreationTime wor the TSM-sysbkp event ? We never saw the before.
We are running OpsMgr 2012 SP1 UR3 on the management servers and on the clients.
No relevant errors in the Operations Manager logs.
thank for all good ideas
sebastian
sebastian