[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[ISSForum] EventCollector is overloaded



Hi, All!

I find great number of events such as:

(EventCollector_RSSPSQL) - Started throttling event rate (due to large
backlog of events waiting to be stored in the database).  If this happens
often, this may be an indication that your Event Collector is overloaded.
[ID=0xc734004c].

and

(EventCollector_RSSPSQL) - Stopped throttling event rate.  [ID=0xc734004d].

But I don't think that it is true, because I have only 5 network sensors, 4
server sensors, 1 internet scanner and fusion module. In ISS documentation
noted 1 EC can support up to 100 sensors!

What the problem is?

I'd installed additional EC and assign it to some sensors, but it didn't
make me happy.

---
Best regards, Sergey V. Soldatov
Department of information security,
TNK-BP.


_______________________________________________
ISSForum mailing list
ISSForum@xxxxxxx

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo