Importing archive from NFS store shows that the events date is from the day the events were archived
Article ID: 404009
Updated On:
Products
Issue/Introduction
Imported an archive as per documentation Import a VMware Aria Operations for Logs Archive and the event(s) date/time is showing the date/time when the events were archived.
Environment
Aria Operations for Logs 8.18.x
Cause
The archive import tool does not have a parser, so anytime you import an archive into Aria Operations for Logs outside the 10 minute window for when the logs were created it defaults to MTIME to get the timestamp.
As the last modification date/time is the date/time the archive was exported, the timestamp when importing will reflect this date/time.
Resolution
Export archive to raw text file as per documentation Export a VMware Aria Operations for Logs Archive to a Raw Text File or JSON
Import the archive in raw text format Using the VMware Aria Operations for Logs Importer tool so you can specify a parser when import the archive. Doing so will mean the timestamp will reflect the date the events occurred.
Additional Information
Feedback
