How to change Subscription time for Generic Events

Event Log Management
6.5 and older
https://kb.netwrix.com/799
Copy Article URL Copied

How do I change my subscription time for a subscription for Generic Events.


Expand to the specific subscription you need to edit, the path will look like the following:

%ProgramData%NetWrixManagement ConsoleAdvanced ReportingSubscription%NameOfManagedObject%Event Log Manager

Where %ProgramData% is the path to your ProgramData folder and %NameOfManagedObject% is the name of the Managed object of the subscription you are wanting to edit. You can find the name of the managed object in the GUI like the following:

Generic Events Managed Object

In the Event Log Manager folder, you will see an XML file for each subscription created.For example, the above subscription "New Subscription" is named: New_x0020_Subscription.xml in the directory.

In this XML file, search for the text "<StartTime>", after this will be a long string, such as "5246793627027387904".

To create a number that you can plug in for the Start Time, perform the following in powershell:

$StartTime = Get-Date -Hour 3 -Minute 15 -Second 0
$StartTime.ToUniversalTime().ToBinary().ToString()
This will output a number like above, you can copy this number and put it in for the <StartTime> in the XML file and then save the XML file. The above example would set a subscription time for 3:15:00 AM. The -Hour flag sets time in a 24 hour span, so 8PM would be 20, 1PM is 13 and so forth. The imagine below shows where StartTime is located in the XML file:
StartTime

After setting the StartTime in the XML file to the above number that is outputted, you can close out of the XML file and re-open the Netwrix Console. You should see the time reflected on your subscription under "Subscriptions".

Go Up