Zenoss 4.2.5 - Incoming trap timestamp

[Sam Nirmal]

Hello,

Is there a way to find out of the exact timestamp of an incoming trap?  I guess maybe SQL query on ZEP DB on the event DB?

Thanks

[Jane Curry]

As I remember it, zentrap processes the incoming trap  (which, of itself, probably doesn't have a time field on it) works out "now" (using Python dateTime call) and uses that value to populate the event's first_seen field.

Cheers,

Jane

[Sam Nirmal]

Ok. I didn't know that "First Seen" is the actual timestamp of an event entering into Zenoss.  

During recent issue with one of the devices which resulted in sending a flood of events to Zenoss collector. In Zenoss I could see the signal queue was sporadically increasing during the issue period.

I had to delete the queue a few times. But it will go up again. The issue remained for a few days.  When the device was fixed ( so I was told ) , the signal queue continued increasing for a few hours after

the device stopped sending the traps. I suppose the event backlog  (somewhere ?)  existed. Looking at the Events in UI, I could see the events  timestamp was just few mins and not hours. This made

me think that the "First seen" might not be the actual one but rather when it was when queued in the pipeline?

Thanks