I have been conducting analysis on the timestamps provided in events in LEM. The Detection Time is the time the network node generated the data. It is important that the network device time is accurate to ensure this time stamp is correct. The Insertion Time is the time the agent or manager created the event. If this is the agent, the time will be the same or very close to the detection time. This does not allow a user to identify if there is a significant time skew between the LEM manager and the agent node.
Such an example is where the LEM manager time is skewed by >5 minutes, resulting in a significant difference in the time between the agent and the manager. If there was an LEM manager timestamp field in the event, this would make this clear. I have seen examples of this issue in customers environments where they are not aware that the LEM manager time is not correct, or in a multi-tenant environment where different domains use different NTP time sources and there is a time skew between LEM and one of the domains. Comparing the DetectionTime and InsertionTime does not highlight the issue. It is currently only found by accessing the CLI and checking the time under manager>viewsysinfo and compare to the servers where the agent is deployed.
