Change Auditor alerts not sent even though the new event appears in search results
説明
Change Auditor Alerts and Alert History are not being created even though events match the Search criteria and SMTP test confirms the SMTP settings are correct. In addition, events from some Change Auditor agents may be alerting normally.
原因
The system clock on the Change Auditor agent computer may be ahead of the time of the Change Auditor coordinator. When the Change Auditor coordinator runs the command to insert the event in the dbo.AuditEvent_AlertQueue, it searches for the event that matches a certain criteria and has a timedetected that occurred before the current system clock time on the Change Auditor coordinator. However, the event will have a timedetected based on the time of the Change Auditor agent computer that is reporting the event. Therefore, if the Domain Controller time is ahead of the Change Auditor coordinator time, the event will get missed because it occurred in the "future".
対策
Ensure all Change Auditor agent computers have a system clock time that matches the Change Auditor coordinator computer.