フリー問題

問題文

An analyst suspects that a rule is not writing records at all, and the central store shows nothing for it. Where should the next check be made?

選択肢

1. In the incident view, because a rule that produces no entries at all appears there as an event that the analyst can open and read.
2. In the configuration change history, because a rule that writes nothing has usually had its logging setting changed by someone who was working on it.
3. In the store with a wider time range, because a record that exists but was delayed in transit will appear once the range is extended far enough to include the moment at which it was finally ingested.
4. On the device, because that distinguishes a record that was never written from one that was written and not forwarded.