AnsweredAssumed Answered

Problems with Windows event collection from Aggregators

Question asked by Shishir Kumar on Mar 1, 2019
Latest reply on Mar 21, 2019 by David Waugh

Hi All,

 

I am currently trying to integrate windows aggregators in our environment. The problem that I am facing is related to the rolling of a channel for the windows logs. I have the following error in the logs:

Log for channel Security may have rolled over. Previous/Current record number: xxxx/xxxx. 

 

As per the RSA link, I have increased the maximum log storage size to 2 GB from 20 MB on the windows aggregator and also tried to change the polling duration.  However, this is still not fixing the issue.

 

I have been trying with different Poll interval / Poll duration and maximum events. Still, I keep getting the same rollover error. Is there a way to derive an optimum setting for polling interval/ poll duration and maximum events ? Thanks for the assistance in advance.

 

Current settings:

Poll duration: 50 seconds
Poll interval: 60 seconds
Maximum events: 200000 

Outcomes