Version

Any

Date

Tuesday, 20 Aug 2013

Summary

Incorrectly configured Rules can generate excessive amounts of Events and Alerts in Argent Console causing slow response

For example, one customer used the Demo Rule and set the CPU limit to 10% — not 100%, but 10%.

In addition, the flag ‘Post Event Even If Same Event Is Still Outstanding‘ was set.

This resulted in 19,000 alerts to be posted to the Argent Console

A reasonable number of alerts in the Argent Console A1A screen is 50 to 500

Technical Background

Rules configured with low thresholds and with option ‘Post Event Even If Same Event Is Still Outstanding‘ can generate excessive amounts of Events in Argent Console

If no action is taken, these Events can flood the Argent Console causing slow response times and not update existing Events

Resolution

Ensure Rule thresholds are set to values that will not breach from normal operations

Only enable option ‘Post Event Even If Same Event Is Still Outstanding‘ for mission critical systems and applications

If excessive Events have occurred, identify which Relators have generated the Events and update their Rules, before purging the unwanted Events from Argent Console

If ODBC Data Truncation errors are seen when purging Events from Argent Console, the Events will need to be purged directly from the ARGSOFT_AAC_CONSOLE table. Contact an Argent Engineer via Instant Help Chat for assistance