Does changing a server time break the deployment monitor?

[andrewfoglesong]

I've set a server running a Universal Forwarder to a time in the future. Would this confuse a Deployment Monitor running on my search head to thinking the UF is "missing" and that it's last checking time was when the time was unmodified?

[andrewfoglesong]

So I was changing the server time to test another component and couldn't tell if it was the other component that was breaking the DepMon or the time difference. I found an alternative way to test the other component and sure enough, DepMon sees it as active and sending data every minute or so. So ajaitz is right, moving the time into the future on a server hosting a UF will break the communication. It both stopped indexing and wasn't reporting in. Changed the time back, and it picked right back from where it left off. Thank goodness it was reversible!

[araitz · Accepted solution]

It depends. At first, I think it would. However, assuming it remains up and the indexer(s) eventually "catch up" to the forwarder's time, it would not note it as missing. In either case, deployment monitor would not be able to provide accurate results for the forwarder in question.

[andrewfoglesong]

Thanks. I'll do some more testing but that makes senes to me.