The Security Server stores all log times at the time that the Security Server received the log.

The time difference between the server logs and client logs depends on the period of sending logs. The WFBS Agent sends the logs for Behavior Monitoring (as well as for the DAC, PFW, Spyware, and Vulnerability Assessment) every two minutes. This two-minute delay is meant to reduce the network traffic of the Security Server. Other logs, like virus logs and WRS logs, are sent immediately. This means that the average log time difference should be less than one minute (given that the network is not disconnected).

When querying virus log count or other log counts, you might miss some logs if you query logs according to the log time recorded by the client. To avoid missing logs, you should query the logs according to the receive time instead.

For example, if the network was disconnected and the client could not upload logs until 5 hours later, and then you want to query the spyware incidents that happened in the last hour through Live Status, you might miss some logs if you query logs according to the log time recorded by the client. You can prevent this from happening by using the receive time in querying the logs.

Also, when displaying the spyware incidents within the last hour, you should show the logs according to the time they were received. If the logs are displayed in client time, then there will be logs from 5 hours ago in the "last hour" report, which would be inaccurate.