Alerter HTTP and fall behind message when Task Output action assigned

[CharlesBeierle]

For some reason I get 'HttpSendRequestEx failed' and 'event data processing falling behind limit threshold' errors when I attach a Task Create Output action to my views. The view that suffers the most contains only four servers (via DeviceGroup) and three correlation rules that are only slightly modified from out of the box rules. SMTP output actions do not cause the problem. I have reinstalled the App Server, created new Task Create rules and views with no success.

I have a ticket open with engineering but some times the IC'ers have the answer. Anyone? Anyone?

[RSAAdmin]

Hi,

You may have already got some feedback from RSA Engineers, There are various flavors of "HttpSendRequestEx failed" messages.

Sometimes it is related to the client and server cannot communicate, because they do not possess a common algorithm and on certain images the TLS1.0 option needs enabling under the NIC_System account login.

There is a KB article on SCOL:

https://knowledge.rsasecurity.com/scolcms/knowledge.aspx?solution=a44664

As suggested there is various floavors to this, pehaps a copy of the full message may help along with the full version of enVision you are currently running.

With regards to the the view falling behind, these are usually related to being poorly constructed however you say this is fairly simple setup and only occurs once you enable the task create output action?? performance issues, whats the load like on the system?

Have you reviewed Event Viewer with Advanced filter contain -6080 (Alerter Messages) and see if it's complaing about anything else?