We've had some issues recently in which we've discovered that no events have been collected for a period of several days, but the manager is up and running as far as we can tell. The issue appears to have been resolved by upgrading to v6.3, however it's raised the following questions regarding how the agents on our Windows servers process collected events.
- Will the agent cache events if it cannot connect to the manager and, if so, what parameters are available for controlling the number of events that are cached and/or the time period that these are retained for?
- Is there a specific Internal event that would indicate that the agent is seeing the manager as online and available and is therefore sending its collected events, but they are never being written to the database? (This is what I suspect was happening in our specific situation.)
Thanks for the help.