Alert time is different between actual issue time and time in template.

  • KM00203266
  • 24-Sep-2012
  • 10-Oct-2013

Summary

Time of Run alerts in case of "For each log entry matched" in Log File monitor or "For each event matched" in Microsoft Windows Event Log Monitor.

Question

When customer sets Run alerts to "For each log entry matched"  or to "For each event matched", customer may additionally want to check time Property tag in templates.

<currentTime>: the time that the alert run
<time>: the time that the monitor completed

This is because in "For each ..." mode, alert(s) need triggered before waiting the completion of the current monitor run, and <time> still points to the completion time of the previous run.

Answer

When customer sets Run alerts to "For each ...", the alert trigger will be issued before monitor completion. So, Using <currentTime> might better for some customer.