A Deployment Professional was asked to investigate the following error:Custom Rule Engine has detected a total of 20487
Posted: Fri Aug 26, 2022 9:58 am
A Deployment Professional was asked to investigate the following error:Custom Rule Engine has detected a total of 20487 dropped event(s). 20487 event(s) were dropped in the last 62 seconds. Queue is at 99 percent capacityThe Deployment Professional needs to run the command/opt/qradar/bin/findExpensiveCustomRules.sh to gather the necessary troubleshooting logs.When should this command be run?
A. Right after a reboot
B. Run “service hostcontext restart” first
C. While the system is dropping events
D. Restart ECS, then run command
A. Right after a reboot
B. Run “service hostcontext restart” first
C. While the system is dropping events
D. Restart ECS, then run command