|Applies To||enVision 3.X|
|Issue||Adding Cached Variables in Correlated Rules|
Cached variables do not save the cached information correctly from the events. The cached variable information needs to be added manually to the correlated rule''s xml file directly.
First, locate the rule on the enVision server (Asrv for LS). The rule is located in the %_ENVISION%\etc\devices\correlation_xxxx folder.
Open the file with notepad. The added line will be the second line in the xml. It will be added after the <cad timestamp> line.
Add the cached variable line using the following options:
For variables within an event
To cache based on the source of the event
Note: The value "thread value =?1?" means it will cache up to 1024 instance of it. This can be increased, but 1 is the recommended value for performance.
|Legacy Article ID||a36671|