System Tagger for McAfee ePO's jobs are incomplete due to maximum amount of time allowed

[evelenke]

Hi Splunkers,

we try to integrate System Tagger for McAfee ePO to apply tags in ePO DB.
But the result is always incomplete - f.e. lt only 17 records were tagged from 300 required.
It seems that the root cause was found in a scheduler.log "

Reached maximum amount of time allowed to spend in per-result alerts... max_alerts_time=300 (seconds), fired_alerts=17

So I have 2 questions:

1. Is it normal that only 15-20 records may be tagged during 5 minutes?
2. How to increase the maximum amount of time allowed to spend in per-result alerts?

[evelenke]

Resolved with adding to system/local/limits.conf:

[scheduler]
max_per_result_alerts_time = 0