IDSXML Collection is Delayed
2 years ago
Originally Published: 2007-11-06
Article Number
000061116
Applies To
Collection
Delay
IDSXML
RSA enVision
Issue
IDSXML Collection is Delayed
Sensor is sending alerts at a rate of 500
Resolution
If you notice an issue with delay on collection of IDSXML events it's due to the fact that the sensor is not sending more then 500 Alerts every time enVision sends a request and slowly it accumulates.
 
To work around it you can increase the IDSXML collection interval.
 
1) run %_envision%\database\cmd\startisql.com
 
2) type
 
   update idsxmlServiceClientConfig set interval=10 
 
 
3) Hit F5
 
4) Close the ISQL GUI
 
5) Restart the IDS XML service.