IBM QRadar

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only

  • 1.  Log Sources Error

    Posted 04/23/19 09:49 AM
    In my environment, I have many log sources that are showing in error due to not sending logs within the allotted timeout threshold.  Instead of increasing the threshold for the entire environment, is there a way to separate the log sources and customize the error threshold?  For example, placing a router in a DR group and changing the threshold to 1200 minutes.....

    ------------------------------
    Jason
    ------------------------------


  • 2.  RE: Log Sources Error

    Posted 04/24/19 02:07 AM
    Hi  Jason,

    This is not feasible to set customise different thresholds for different log sources.

    Regards,
    Kanishk

    ------------------------------
    Kanishk Jawaji
    ------------------------------



  • 3.  RE: Log Sources Error

    Posted 04/25/19 01:09 AM
    Hi Jason,

    yes you can customize your thresholds. Check out this topic that explains how:
    https://community.ibm.com/community/user/security/communities/community-home/digestviewer/viewthread?MessageKey=4da55c8f-ae04-467b-8088-65940000e36d

    For technical details, check out IBM's literature:
    https://www-01.ibm.com/support/docview.wss?uid=swg21991768
    https://www-01.ibm.com/support/docview.wss?uid=swg21981697

    Good Luck!

    ------------------------------
    Anthony Gayadeen
    Analyst
    Videotron
    QC
    ------------------------------



  • 4.  RE: Log Sources Error

    Posted 04/25/19 01:21 AM
    Hi Jason,
    I've just noticed that you also posted the other question which is quite similar (Silent Device Log Sources).

    https://community.ibm.com/community/user/security/communities/community-home/digestviewer/viewthread?MessageKey=4da55c8f-ae04-467b-8088-65940000e36d

    You should try and stay in the same discussion instead of replicating it.
    Thanks!

    ------------------------------
    Anthony Gayadeen
    Analyst
    Videotron
    QC
    ------------------------------

    Original Message


Related Content