5.4 Event Sources

The Event Sources page allows administrators to configure how time is determined for events from each event source. The event time can be based on the time stamp from the event source (“trust event time”) or the time stamp from the Identity Audit server. The time stamp affects the order in which events are displayed in a search if you sort by time. The time stamp also affects the display time in reports. The default is to use the Identity Audit server time.

NOTE:An NTP server is recommended to keep time synchronized on all machines in the Identity Audit system. If an NTP server is available, you should trust the event time for the applications. If an NTP server is not available, you should use the Identity Audit server time for all applications (which is the default setting) to correct for any time differences between machines.

To change the event time options:

  1. Log into Identity Audit as an administrator.

  2. Click the Collection link at the top of the screen.

  3. Click the Configuration link on the right side of the screen.

  4. Click Event Source.

  5. Select all applications for which Identity Audit should use the event time stamp from the original application.

    For all others, the Identity Audit server time stamp replaces the time stamp from the original application.

The changes take effect immediately for all new incoming events. It might take some time for events already in the queue to be processed.