I had this issue when my Event Collector became overloaded because of too many alerts per second (I believe the max is 500). Look for EC warnings that mention throttling.
If that's the issue you'll need to add another EC or lessen your alerts.
Hope this helps.
Marc Soda, CISSP
Information Security Engineer
From: Ayden Nash [mailto:Ayden@xxxxxxxxxxxxxxxx]
Sent: Tuesday, January 27, 2004 7:49 PM
Subject: [ISSForum] False data and time for events
Alerts seen in siteprotector all have wrong date/time's associated with them, even though the operating systems they
run on have the correct time. Is seems the run time's of sensor updates etc. are ~9 hours behind. Where are these false times
ISSForum mailing list
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo