Here is the basic explanation from the IDM User Guide:
Event Retrieval-Lets you set a threshold for when the last event was retrieved and whether this metric is applied to the overall sensor health rating.
Note The event retrieval metric keeps track of when the last event was retrieved by an external monitoring application such as IME. Disable Event Retrieval if you are not doing external event monitoring.
http://www.cisco.com/en/US/docs/security/ips/7.0/configuration/guide/idm/idm_sensor_management.html#wpxref98287
There are 3 primary methods by which events are monitored: Subscription, Query, and Traps
A Subscription is used by external Monitoring Tools. The typical Cisco tools for Monitoring are IME (Intrusion Prevention Manager Express) and CS MARS.
If you don't already own CS MARS, then IME is recommended. If you have a service contract for your sensor (which you need for upgrading signatures), then as part of that contract you can download and use IME at no extra cost.
IME maintains a Subscription with the sensor. Think of it similar to a magazine Subscription where you keep on getting next months magazine unless you cancel your subscription. IME sends an open message to the sensor to start the Subscription, and then just keeps asking for new data as part of that Subscription.
Other 3rd party tools are capable of using Subscriptions as well. If you are using a 3rd part management tool for monitoring then contact that company to see if their tool uses a Subscription.
This specific health statistic for event retrieval is to let you know if your subscriptions are up to date.
In your case it doesn't like you have any tool that has even started a subscription so your sensor health is red.
If you don't plan on using a Monitoring tool that does Subscriptions, then disable the Event Retrieval Statistic from your sensor health.
This way Event Retrieval is ignored by the sensor when determining the Health of the sensor.
The second method for monitoring events is through a Query.
Using the magazine example, a Query is more like walking down to the local store and buying the new magazines one at a time. You don't automatically get next months magazine sent to you.
The IDM (Intrusion Detection Device Manager) has Event Monitoring screens, but these screens do one time Queries. If you want more data from the sensor you have to hit a button and it will grab one more set of data from the sensor. But it has to specifically ask each time.
The "show event" command from the sensor CLI is ALSO treated as a Query.
Some 3rd part monitoring tools also have coded to pull events using a Query instead of a Subscription.
The Event Retrieval statistic does NOT track Queries. So if you use IDM, CLI, or a 3rd party tool using Queries; then it has no affect on the Event Retrieval status.
You either need to switch to using a tool like IME that does do Subscriptions, or disable Event Retrieval as a statistic for sensor health.
The 3rd method is to use SNMP Traps.
SNMP Traps are done over UDP and not guaranteed to arrive at the monitoring tool.
So similar to Queries, the sending of SNMP Traps does not affect the Event Retrieval status.
If you are using SNMP Traps for monitoring, then you can disable the Event Retrival as a statustic for sensor health.
Hope this has made more sense out of what you are seeing.
