"Number of events currently in the queue is using 80% or more of the queue."
One of my Policy's rule for Log Decoder has triggered the Critical Error. Where do I adjust the size of the queue (if it is possible)? Or where do I clean the existing queue?
I am not sure it is related but my Concentrator shows the status: "Initializing Index" (instead of "Ready")
Thanks in advance.
This is the policy details for that log collector H&W alert
The Log Collector queue holding log events to be sent to the Log Decoder has exceeded 80%. This could be due to the Log Decoder not being able to keep up with the collection rate, the Log Decoder collection being disabled, or the Log Decoder service being down or otherwise non-functioning.
Possible Remediation Action:
1. Ensure the Log Decoder service is running.
2. Ensure collection is enabled on the Log Decoder.
3. Ensure collection counts are increasing on the Log Decoder.
4. Check the CPU utilization and Load avg on the Log Decoder appliance.
please check the 4 items listed here to validate they are not the issue.
Eric, thanks for suggestion. I have the CPU running at almost 100% constantly. What does it indicate?
Sr. IM Security Analyst
307 International Circle
Hunt Valley, MD 21030
P: 410-560-2269 x.1261
I would check the linerate coming into the log decoder/ collector to make sure its not pushing the appliance too hard.
I might track down the swapcheck.sh script and run that on the log decoder to see what services are consuming swap and go from there.
A support ticket will get you quicker assistance with this if you need it.