000035757 - Group Aggregation EPS rate drops when native aggregation from single source is triggered in parallel in RSA Security Analytics

Document created by RSA Customer Support Employee on Dec 9, 2017
Version 1Show Document
  • View in full screen mode

Article Content

Article Number000035757
Applies ToRSA Product Set: NetWitness Logs & Packets, Security Analytics
RSA Product/Service Type: Concentrator, Group Aggregation
RSA Version/Condition: 10.6.x
Platform: CentOS
O/S Version: EL6
IssueWhen Group aggregation (aka. query-based aggregation) is targeting a Concentrator and normal (aka. native) aggregation is started from a different appliance targeting the same Concentrator, the Group aggregation performance drops significantly.
ResolutionThis issue is currently being investigated by the Engineering team in order to resolve it in a future release.
If you are experiencing this issue, contact RSA Customer Support and quote this article number for further assistance.
NotesMore information on Group Aggregation can be found in the RSA Security Analytics 10.6.5 Product Documentation.