Knowledge Base

Yes

Environment

Why did an alert fire for an older event?

Sensor was not connected to the server between the period of the event and the time the alert was triggered

The sensor core driver stores up to 12k in memory for events. Events then get rolled to disk during the stop of services. During this, if the memory limit or storage limit are hit, newer events will be dropped.
Utilize the /var/log/cb/nginx/access.log to check when sensor first started to check in. The following command can help. sensorid can be found in the sensor's details page.
```
zcat /var/log/cb/nginx/access.log | grep '/<sensorid> '
```
Compare the GMT time to firewall logs