000024541 - IDSXML Collection is Delayed

Document created by RSA Customer Support Employee on Jun 16, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000024541
Applies ToCollection
Delay
IDSXML
RSA enVision
IssueIDSXML Collection is Delayed
Sensor is sending alerts at a rate of 500
Resolution
If you notice an issue with delay on collection of IDSXML events it's due to the fact that the sensor is not sending more then 500 Alerts every time enVision sends a request and slowly it accumulates.
 
To work around it you can increase the IDSXML collection interval.
 
1) run %_envision%\database\cmd\startisql.com
 
2) type
 
   update idsxmlServiceClientConfig set interval=10 
 
 
3) Hit F5
 
4) Close the ISQL GUI
 
5) Restart the IDS XML service.
Legacy Article IDa37608

Attachments

    Outcomes