Hello. I have notifications setup to send to send e-mails for a single risk event, and risk outbreak. The e-mails are always delayed, sometimes up to one hour +. Is there a setting that will allow for the e-mails to be sent immediately? SEPM version 12.1.2015.2015 running on Windows Server 2008 R2

Set the Damper in the notification to "Auto"

Thanks for the quick reply, but unfortunately, that was default and I left it at auto. I also tried 20 minutes after several test runs on auto and waiting more than 20 minutes between tests.

I've attached a snippet from one of the single risk e-mails. As you can see the virus was caught at 2:13p, but the alarm wasn't generated until 3:05p.

What is your heartbeat set to?

Ah! Good call, sir! Heartbeat was set to 30 minutes. I've changed it to one for testing and will do in a bit. I'll post with results. Thanks for your help.

That likely explains the "delay"

I think this is by design , Check this document

 

Scheduled reports don't cover the expected scheduled time.

Hi

Please follow the link below

http://www.symantec.com/business/support/index?page=content&id=TECH104921&actp=search&viewlocale=en_US&searchid=1368158792592

Regards

 

Thanks to all. By setting the log aggregation, heartbeat, and damper to the smallest amount of time allowed, I've gotten the delay down to a mostly acceptable number.

One quick question regarding the damper, though. Is there any way to set that lower than 20 minutes outside of the SEPM gui? database value, regsitry value, or something like that? I small delay for single risk events is more than acceptable, but I would like to be notified of a potential outbreak as soon as possible, for obvious reasons.

The delay is mostly based on the heartbeat setting. If damper is at auto, it's basically waiting for any alerts and will send out immediately. I really wouldn't go lower than 15 minutes on a heartbeat though as it can depend on a number of things and you may start to see some network congestion.

 

HI, 

Please find the KB article

http://www.symantec.com/docs/TECH173856

Regards

Ajin