envision alert - event data processing falling behind limit threshold
Since last night i m getting strange alert in the nic-view.
Alert says " %NIC-3-608031: Alerter Alerter - - - - Detail: 3396: 9729 view=firewall event data processing falling behind limit threshold(600s) at 2216 seconds "
I m getting alerts like this for all my views.
Can anybody explain, why is this happening.
EPS was above the max limit at the time this alert started firing.
But envision didnot stop alerting this event even after the eps had gone down.
I had to restart the nic manager to stop the alerts. Is this the correct way if this occours again?
Alerter performance can depend on various factors like devices, deployment(Sites, LC and RC), no of views and their configuration(Output action specifically) etc.
Please send the 608801, 608031 and 608030 messages (LSData) from that timeframe.
You can also raise a support call if problem persists.
This should allow you to narrow down the view that is causing the issue....then it is a matter of finding the alert that may be the culprit. It sometimes only takes one bad alert to impact all of the views.