Evt_AeX_Client_Crash_Detection table - What does duration column mean?
|Article:HOWTO83479|||||Created: 2013-01-29|||||Updated: 2013-02-06|||||Article URL http://www.symantec.com/docs/HOWTO83479|
The intiger value in the duration column does not mean anything useful. Its a legacy value. The customer can ignore it, all the useful information is in other columns, like time, process, module and the most important – the crash dump. Our development uses the DMP or EZ files when investigating crashes.
This table is populated by an NSE that is generated when there is an Agent crash.
This table contains some references of the crashes on any client machine that has reported one.
We use this information in the "Faults" reports under "Reports>Notification Server Management>Agent"
This table is created by the "Reports_Agent_CrashDetection.config", under the '...\Program Files\Altiris\Reports\Config" directory.
The duration means, as far as we were told, how long the Agent was down until it recovered. When the Agent crashes, it needs to wait for Windows to write the crash dump before we force the Agent to recover. So, the duration is taken by the subtraction of when the crash occurred and when the NSE was sent.
Article URL http://www.symantec.com/docs/HOWTO83479