What is the size limit for UCF Cache File?
What is the file size limit for the #UCF cache file before it can no longer ingest new alerts from NetWitness?
- "secops_import_archer.data" located in "C:\Program Files\RSA\SA IM integration service\data-collector\cache"
- Community Thread
- Forum Thread
- RSA Archer
- RSA Archer Suite
- Unified Collector Framework
I am not aware of any limitation on the cache size. In a Lab environment, I sent 7145 syslog alerts in the span of about 2 hrs and the cache size went up to 12MB. However, the problem is the amount of time the UCF takes to create/update records in SecOps. In the Lab environment, it took about 23 hrs to process all 7145 alerts, so Archer performance will also play a factor. There may be some configuration changes to the UCF to help speedup the process (e.g. disabling Device record searches).