/2/team_log/get_events not returning events

VeraSecurity

There was a file_add event which happened at 

"timestamp":"2020-02-10T19:10:20Z"

And during the day we were making API calls every 15 seconds with the following parameters,

2020-02-10--19:52:21.101 https/api.dropboxapi.com/2/team_log/get_events, {"limit":100,"time":{"start_time":"2020-02-10T16:52:38Z","end_time":"2020-02-10T19:52:11Z"},"category":"file_operations"}
2020-02-10--19:52:35.579 https://api.dropboxapi.com/2/team_log/get_events, {"limit":100,"time":{"start_time":"2020-02-10T16:52:39Z","end_time":"2020-02-10T19:52:25Z"},"category":"file_operations"} 
2020-02-10--19:52:50.122 https://api.dropboxapi.com/2/team_log/get_events, {"limit":100,"time":{"start_time":"2020-02-10T16:52:40Z","end_time":"2020-02-10T19:52:40Z"},"category":"file_operations"}
...
...
...
2020-02-11--07:43:15.370 https://api.dropboxapi.com/2/team_log/get_events, {"limit":100,"time":{"start_time":"2020-02-10T17:41:37Z","end_time":"2020-02-11T07:43:05Z"},"category":"file_operations"}
2020-02-11--07:43:29.818 https/api.dropboxapi.com/2/team_log/get_events, {"limit":100,"time":{"start_time":"2020-02-10T17:41:38Z","end_time":"2020-02-11T07:43:19Z"},"category":"file_operations"}

And finally at the following time we started receiving events which included the event which happened at 2020-02-10T19:10:20Z
2020-02-11--07:43:44.336 https://api.dropboxapi.com/2/team_log/get_events, {"limit":100,"time":{"start_time":"2020-02-10T17:41:39Z","end_time":"2020-02-11T07:43:34Z"},"category":"file_operations"} 
   

 In another process which was using cursors, we got the same event much before (around "2020-02-10--22:26:50.812")

Is it possible that we might not see events some times when using start/end time, but using the cursor you will receive the event?

VeraSecurity

This is another instance which was observed in manual testing,

There is a event with 

"timestamp": "2020-02-24T09:31:44Z"

 

When issuing a request with,

{"limit":100,"time":{"start_time":"2020-02-24T09:31:42Z","end_time":"2020-02-25T09:40:00Z"},"category":"file_operations"}

The response is,

{
    "events": [],
    "cursor": "AAC41C6wZ7p3ovi7dlNz0-ghEj-vgnWs16cWMnYkn9-IyZ4b7WfHxnCcFhBxsAt6wjkUj3Vlm6A3F5Zbfx-lODcTbj9Il0kUUQHXoPvbmTI1WUvcHvvGw4EQiq_DYlx_9P-O6HAXLBcWHi4-qiskVzq6yKjsDh3lvI50qJpNkYAjgQrjkBqJP1HYF5eSXngJHjaj0guS9wrQzaUfWkNPqNqPQDCZCe6SmtoV2bwa6Ts-6nRHd9tXAZqCsv5_2clK28xvqrb7iIJITB81LI6qwvezitdzV8TFSbUM-uVzGuHalmn9qaWmgLBBqtW5E9nQ1amrenoVUXE9ElBKwteY5nHJ54z4Pdd3SBKIoWWsPCtLOlvM0pB7GOpz3XEsSCJ5PdHaO346xLRO_kUInf9quPNdPvieuw2DIUTC0Z3NhWie-w",
    "has_more": true
}

So eventhough there is a event in the timerange, no events are returned but "has_more=true" and if I use the cursor and /continue, the event is returned.

 

Just noticed in the documentation that "Note that has_more may be true, even if events is empty". So we cannot just rely on events being empty to stop polling. Looks like this is the problem we are running into.