Hi Splunkers,
we try to integrate System Tagger for McAfee ePO to apply tags in ePO DB.
But the result is always incomplete - f.e. lt only 17 records were tagged from 300 required.
It seems that the root cause was found in a scheduler.log "
Reached maximum amount of time allowed to spend in per-result alerts... max_alerts_time=300 (seconds), fired_alerts=17
So I have 2 questions:
Resolved with adding to system/local/limits.conf:
[scheduler]
max_per_result_alerts_time = 0