Client Management Suite

I've been seeing this recently, where we have monitors setup for service restarts or low-disk space alerts.  For example, this morning, we received an alert for a server that was low on disk space...email came in at 9:05AM, Date/Time stamp on the alert was 9:03AM.  This is fine.  However, at the same time I received an alert from another server...email also arrived at 9:05AM, however the Date/Time stamp on the alert was 7:18AM.   Similar issues with expected service restarts yesterday evening that were showing up an hour after they occured.  Obviously this causes a problem for any troubleshooting if we're not getting the alerts in a timely manner.  Nothing has changed recently...no new monitors, no server upgrades, no software upgrades.   Can anyone point me in a direction for troubleshooting?  Thanks!

At least in 7.6 HF7 release if you have an agent-based or an agentless monitoring, then received alert will has current NS machine date/time when alert raises.

For example

• NS: 9/1/2016 - 12:12 PM
• Monitored resource: 9/1/2016 - 1:12 PM

Triggered rule on monitored resource will send an alert via nse file and on NS machine this alert will has date/time of NS machine (9/1/2016 - 12:12 PM) but not date/time of monitored resource (9/1/2016 - 1:12 PM).

Probably your current NSE Queue is full and there is a lot of nse files which are processing in their order, and probably there was a delay when sent alert from monitored resource hasn't been immediatelly processed due NSE queue full and triggered a send email task. You can try to monitor your current NSE Queue on NS machine using custom reports from this article and check directly on NS machine this location C:\ProgramData\Symantec\SMP\EventQueue\EvtQueue

Also check this article to make your database more healthy

• https://support.symantec.com/en_US/article.DOC9186.html