Can't see the nugget but can see the event in the enVision console???

[RSAAdmin]

I can see the realtime events in the enVision console (Analysis -> Event Viewer -> Message View) but for some reason I cannot see the nugget in the nugget folder (D:\tmp\nuggets\ciscoswitch\[ip address]). I am sure that is the correct folder that I went to because I can even see the timestamp of the folder been changing every minute!! I keep clicking the refresh botton but still can't see new nugget being created. I have checked the folder permission and there is nothing wrong with it...

[RSAAdmin]

Have you checked the status of said device under "Manage Monitored Devices". What status is it in?

Are you able to create a query or report on the logs?

[RSAAdmin]

The Collection status says "Active", and the "Analyze" and "Has timestamp" boxes are ticked.

[RSAAdmin]

And yes I can create query and alerts based on the events.

[RSAAdmin]

Nuggets are created by Collector and they will be consumed by Packager service and pushed to IPDB from where you are seeing the events in enVision and are able to see alerts.

[RSAAdmin]

Yes but I thought the nuggets are processed every minute, so I should see a nugget file in the folder and at least it will be there for a minute (before it's processed)?

[RSAAdmin]

Yes, the nuggets are processed every minute, Collector creates the nugget file at minute change. If the event traffic from a device is not huge, then you won't be able to see nugget file because Collector stores the messages in memory and only if the events are more than you will be able to see a .txt file, and when the minute changes this .txt file is renamed to .nug file.