[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

RIF: [ISSForum] network sensor queue size



Hi Jean Paul 
thank you very much for you answer
is there a way to  know how many events per minute i get from the sensor?
or i have simply to monitor that sensor with the console?

Regards

Gian Fabio


-----Messaggio originale-----
Da:	Ballerini, Jean Paul (ISS EMEA) [mailto:JPBallerini@xxxxxxx]
Inviato:	gio 15/07/2004 14.12
A:	Palmerini Gian Fabio; issforum@xxxxxxxxxxxxxxxx
Cc:	
Oggetto:	RE: [ISSForum] network sensor queue size

Gian Fabio,

It can be greater. Normally the queue doesn't contain many events.
The way to tune it is:
- know how many events per minute you get from the sensor
- know how much time you estimate it would take to restore a situation
where the sensor can communicate with the Event Collector or where the
EC cannot talk to the Database
- multiply the two factor considering that the average size of an event
(without any binary information) is 1500 bytes.

I am sure disk space is not an issue.

Once all connections are back in place you'll have all the queued events
flow to the DB; the bigger the queues, the longer this process will
take.

I hope this helps.

Jean Paul

-----Original Message-----
From: issforum-bounces@xxxxxxxxxxxxxxxx On Behalf Of Palmerini Gian
Fabio
Sent: Thursday, July 15, 2004 10:01 AM
To: issforum@xxxxxxxxxxxxxxxx
Subject: [ISSForum] network sensor queue size

Hi Folks
what is the suggested size of the queue for a netwrk sensor giga and
100Mb?
I have it setted to 45Mb
Can it be greater??

Thanks
Gian Fabio


_______________________________________________
ISSForum mailing list
ISSForum@xxxxxxx

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum

To contact the ISSForum Moderator, send email to mod-issforum@xxxxxxx

The ISSForum mailing list is hosted and managed by Internet Security
Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.




_______________________________________________
ISSForum mailing list
ISSForum@xxxxxxx

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum

To contact the ISSForum Moderator, send email to mod-issforum@xxxxxxx

The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.