Have alerts actually occurred for there to be a history for that particular device? Have you verified that all the severities for the events are checked for the machine's events in the viewer?

For what its worth, I have also noticied inconsistencies within the interface for viewing events as well. I have not tried to narrow down where in the code it is possibly wrong, however.

Do you see those criticals in the events.history table in the Zenoss MySQL DB?

You would log into the shell via SSH where Zenoss is running. From there, as the zenoss user, run mysql -uroot -p and put in your MySQL root password (you should have this from when you installed and setup the server). Once in you can do a show databases; command to see what databases are listed. By default, Zenoss uses the events database. After that, type use events; Running show tables should get you a listing of the tables, look for the history table and type this: select * from history where device = 'device' and firstTime > '2012-08-05' order by lastTime\G;

Here are the commands step by step:

• Login to Zenoss server as zenoss user
• mysql -uroot -p - put in your MySQL password
• show databases;
• use events; <- if your default Zenoss DB is events
  
• show tables;
  
• select * from history where device = 'device' and firstTime > '2012-08-04' order by lastTime\G;
  

The last command should print out some lines showing you events that occurred on or after 8/4 through today for that specific device...

BTW, there may be several meta-events about state change or various internal changes, they can be ignored and don't show up in the events for the device itself within Zenoss' UI.

No problem

Ah, this sounds like they were deleted. Did you acknowledge the events or delete them?

Sounds good, sorry I couldnt be of more assistance. Once I get time I plan to research the loss of events because I have noticed it as well on certain events/devices - almost certain there is a bug in there somewhere.