AnsweredAssumed Answered

NW Health Issues

Question asked by Renato Goncalves on Sep 21, 2018
Latest reply on Sep 26, 2018 by Renato Goncalves

Like • Show 0 Likes0
Comment • 5

Hello guys

Recently it was given to me the task of assuring that NW runs smooth.

I was viewing some documentation from the community and saw:

Verification of the 95% threshold

To ensure that the NW database directory sizes are configured with the correct 95% threshold, in the Security Analytics UI:

Go to the Security Analytics service Explore view, right-click on Properties and select reconfig.
In the parameters field, type Update=0 and click Send. The response output will check the host storage and attached storage, and automatically calculates what the 95% threshold is.
When you type Update=1 and click Send, the response output displays the same response as in the previous step, but when you refresh the Explore view, you will see that the session, meta, and packet database directories size have been updated to 95% of the current available storage.
Restart the Concentrator or Decoder service for the changes to take effect.

Has im using version 11 and dont know where to go. Is it Admin- Services and then in the concentrator select config? If so where do i put update=0?

Thanks

No one else has this question

Outcomes

Joshua Randall

Sep 21, 2018 5:25 PM

Hi Renato,

These options are in the Explore menu:

Under the /database and /index nodes, you can select "config” to see what the current settings for each db are (session.dir and meta.dir under /database/config; and index.dir under /index/config):

You can run through the steps listed in your question by right-clicking on the /database and /index nodes, selecting "Properties,” and in the frame that opens at the bottom of the page select "reconfig” and enter your commands in the "Parameters” box:

Hope this helps.

Actions

Renato Goncalves Sep 24, 2018 5:19 AM

Hello Joshua,

Thanks for all the help you giving me throw time.

One thing i noticed is that theres been a few changes in the boards. For example: When i try to see if the ESA MongoDB is 5GB, according to the documentation i shoul be doing: Administraton - Services - ESA Event Stream Analisys - View - Explore - Alert - Storage and Maintenance but we do not have the option Storage:

Is by any means trustful to follow https://community.rsa.com/docs/DOC-78965#Log ?

Actions

Renato Goncalves Sep 25, 2018 6:38 AM

Hello Joshua,

Since you have much more experience than i do in monitoring health for NW may i ask you a question?

Its usual for the IIS to send large chunks of events in a 5H windows and smaller one until it reaches 5H difference?

As you can see its giving us a bigger number of events ( 32.000 as maximum ) and then for 5 hours it only gives us 28, 4, 5 events has you can see in the pictures.

Is it normal? Where can i see if its a configuration problem or is it normal according with the configuration that was made by our log decoder/collector admins?

Actions

Eric Partington

@ Renato Goncalves on Sep 25, 2018 2:01 PM

IIS is normally a file collection deployment so the logs will be sent in a scheduled basis from the IIS server(s). So if your interval to send logs is 5 hours then thats what you will see.

Microsoft Internet Information Services Event Source Configuration Guide

Check the guide to see where the configs are for the integration and verify the reporting interval.

Actions

Renato Goncalves @ Eric Partington on Sep 26, 2018 6:15 AM

Hello Eric,

We were thinking that but just needed confirmation of our responsible for log-collector installation and someone whow had much more experience, like you.

Thanks for the reply and the help

Actions

5 Replies

Joshua Randall Sep 21, 2018 5:25 PM
Mark Correct
Correct Answer
Hi Renato,
These options are in the Explore menu:

Under the /database and /index nodes, you can select "config” to see what the current settings for each db are (session.dir and meta.dir under /database/config; and index.dir under /index/config):

You can run through the steps listed in your question by right-clicking on the /database and /index nodes, selecting "Properties,” and in the frame that opens at the bottom of the page select "reconfig” and enter your commands in the "Parameters” box:

Hope this helps.
Like • Show 0 Likes0
Actions
Renato Goncalves Sep 24, 2018 5:19 AM
Mark Correct
Correct Answer
Hello Joshua,

Thanks for all the help you giving me throw time.

One thing i noticed is that theres been a few changes in the boards. For example: When i try to see if the ESA MongoDB is 5GB, according to the documentation i shoul be doing: Administraton - Services - ESA Event Stream Analisys - View - Explore - Alert - Storage and Maintenance but we do not have the option Storage:

Is by any means trustful to follow https://community.rsa.com/docs/DOC-78965#Log ?
Like • Show 0 Likes0
Actions
Renato Goncalves Sep 25, 2018 6:38 AM
Mark Correct
Correct Answer
Hello Joshua,
Since you have much more experience than i do in monitoring health for NW may i ask you a question?
Its usual for the IIS to send large chunks of events in a 5H windows and smaller one until it reaches 5H difference?

As you can see its giving us a bigger number of events ( 32.000 as maximum ) and then for 5 hours it only gives us 28, 4, 5 events has you can see in the pictures.

Is it normal? Where can i see if its a configuration problem or is it normal according with the configuration that was made by our log decoder/collector admins?
Like • Show 0 Likes0
Actions
- Eric Partington @ Renato Goncalves on Sep 25, 2018 2:01 PM
  Mark Correct
  Correct Answer
  IIS is normally a file collection deployment so the logs will be sent in a scheduled basis from the IIS server(s). So if your interval to send logs is 5 hours then thats what you will see.
  Microsoft Internet Information Services Event Source Configuration Guide
  Check the guide to see where the configs are for the integration and verify the reporting interval.
  Like • Show 0 Likes0
  Actions
  - Renato Goncalves @ Eric Partington on Sep 26, 2018 6:15 AM
    Mark Correct
    Correct Answer
    Hello Eric,
    
    We were thinking that but just needed confirmation of our responsible for log-collector installation and someone whow had much more experience, like you.
    
    Thanks for the reply and the help
    Like • Show 0 Likes0
    Actions

NW Health Issues

Outcomes

Related Content

Recommended Content