A Deployment Professional was asked to investigate the following error:Custom Rule Engine has detected a total of 20487 dropped event(s). 20487 event(s) were dropped in the last 62 seconds. Queue is at 99 percent capacityThe Deployment Professional needs to run the command/opt/qradar/bin/findExpensiveCustomRules.sh to gather the necessary troubleshooting logs.When should this command be run?
A. Right after a reboot
B. Run “service hostcontext restart” first
C. While the system is dropping events
D. Restart ECS, then run command
A Deployment Professional was asked to investigate the following error:Custom Rule Engine has detected a total of 20487
-
answerhappygod
- Site Admin
- Posts: 899604
- Joined: Mon Aug 02, 2021 8:13 am
A Deployment Professional was asked to investigate the following error:Custom Rule Engine has detected a total of 20487
Join a community of subject matter experts. Register for FREE to view solutions, replies, and use search function. Request answer by replying!