Drop behind sessions on Concentrator
Is there no way to drop the behind sessions from being processed on the Concentrator? For instance, we can delete the rdq files from the Log Decoder. Is there no similar way on the Concentrator?
- Community Thread
- Forum Thread
- Log Decoder
- RSA NetWitness
- RSA NetWitness Platform
you can modify the Aggregate Hours parameter from 0 (aggregate all the available data) to for example 24 that means aggregate only the last 24 hours from the decoder:
Stop the concentrator, change the parameter, restart the concentrator and wait until the behind is recovered.
Remember to set back the value to 0 and restart the concentrator.