|Applies To||RSA Product Set: NetWitness Logs & Network|
RSA Product/Service Type: ESA host/ESA Correlation service
RSA Version/Condition: 11.4.x
|Issue||Metric collection in Esper 8.2.0 is different than in the previous 7.1.0 version. For an ESA Correlation server with rules that consume a lot of memory, the gathering of metrics can consume significant CPU, leading to a drop in EPS when the metrics are being collected. To avoid the drop in EPS, the default interval to collect metrics in RSA NetWitness Platform 11.4 is set to a very large value (999999 days). This prevents the Esper metrics from being collected.|
|Cause||Esper upgrade from 7.1.0 to 8.2.0 with RSA Netwitness Platform 11.4 and higher on the Event Stream Analysis server.|
|Workaround||If you need metrics collected at a more frequent interval, you can update the background-metrics-frequency parameter on the ESA Correlation service.|
Do not set the metrics collection interval lower than five minutes.