Hello, has anyone else experienced their AQL-based Custom Event Properties disabling on their own?  I have to enable them via the Custom Event Properties application from the Admin page.  This is troublesome as this will fire one of my rules if the custom event property (based on the GEO::LOOKUP function) returns N/A.

Thanks

Hi Thomas,

we had this exact problem last year and we got a workaround from IBM support.

This workaround disabled the calculation of the cost from your custom properties and thus leads to properties not being disabled anymore.

On any system running ecs-ec (EP, EC, DG, etc)

Add 'regexMonitor.enabled=false' (without the single quotes) at the end of the below files:

1. vi /store/configservices/deployed/globalconfig/frameworks.properties
2. vi /store/configservices/staging/globalconfig/frameworks.properties
3. vi /opt/qradar/conf/frameworks.properties

 Restart services:

1. systemctl restart ecs-ec-ingress
2. systemctl restart ariel_proxy_server
3. systemctl restart ariel_query_server (only needed on managed hosts)

Great - thanks!

Hi Kim,

we are going through this issue too, even if not only AQL properties but also regex "DSM out-of-the-box" properties sometimes get disabled.

We have quite a large deployment (36 MHs) and only 2 or 3 are sometimes experiencing property disabling, could it be possible to disable regex monitor (by editing the mentioned config files) only on those?

Thanks,

Davide