All Apps and Add-ons
Highlighted

System Tagger for McAfee ePO's jobs are incomplete due to maximum amount of time allowed

Contributor

Hi Splunkers,

we try to integrate System Tagger for McAfee ePO to apply tags in ePO DB.
But the result is always incomplete - f.e. lt only 17 records were tagged from 300 required.
It seems that the root cause was found in a scheduler.log "

Reached maximum amount of time allowed to spend in per-result alerts... maxalertstime=300 (seconds), fired_alerts=17

So I have 2 questions:

  1. Is it normal that only 15-20 records may be tagged during 5 minutes?
  2. How to increase the maximum amount of time allowed to spend in per-result alerts?
0 Karma
Highlighted

Re: System Tagger for McAfee ePO's jobs are incomplete due to maximum amount of time allowed

Contributor

Resolved with adding to system/local/limits.conf:

[scheduler]
maxperresultalertstime = 0

0 Karma