ESA Config: Step 2. Configure Advanced Settings for an ESA Service

Document created by RSA Information Design and Development on Sep 13, 2017Last modified by RSA Information Design and Development on Oct 4, 2017
Version 5Show Document
  • View in full screen mode
 

This topic provides instructions to configure advanced settings for an Event Stream Analysis service.

In the Advanced view, you can configure advanced settings to improve performance, to preserve events for rules with multiple events, to buffer events in memory, and to specify the number of events to be stored on the ESA.

Procedures

Configure Advanced Settings

To access the Advanced view and configure advanced settings for an ESA service:

  1. Go to ADMIN > Services.
    The Services view is displayed.
  2. In Services view, select an ESA service and Actions icon View > Config.
  3. Select the Advanced tab.
    The Advanced view is displayed.

Event Stream Analytics Service Advanced Tab

Configure Alert Engine Settings

In the Alert Engine section, you specify values to preserve events for rules that choose multiple events.

Note: After you upgrade to 10.5, the Debug Rules option if enabled previously will be disabled. You will need to enable this option after upgrade. 

The following figure shows the Alert Engine section.

Alert Engine Section

To configure Alert Engine settings:

  1. In the Alert Engine section, specify a value for Max Constituent Events. The default value is 100.
  2. Select Debug Rules? to enable debugging rules.
  3. If you want alerts to be sent to Message Bus and Respond, select the Forward Alerts On Message Bus option.
  4. To specify the maximum number of alerts to be forwarded to the Message Bus for the trial rule, select Max Alerts Per Second for a Trial Rule. The The default value is 10.
  5. Click Apply to save the changes and put them into effect immediately.

Note: For more information on the parameters in the Alert Engine section, see Alert Engine Settings in ESA Advanced View.

Configure Event Stream Engine Settings

In the Event Stream Engine section, you specify details to improve performance.

The following figure shows the Event Stream Engine section.

Event Stream Engine section

To configure Event Stream Engine settings:

  1. In the Event Stream Engine section, specify Max Pattern Subexpressions.
  2. Click Apply to save the changes and put them into effect immediately.

Note: For more information on the parameters in the Event Stream Engine section, see Event Stream Engine Settings in ESA Advanced View.

You are here
Table of Contents > Configure ESA Correlation Rules > Step 2. Configure Advanced Settings for an ESA Service

Attachments

    Outcomes