Hello,

We have started seeing some of our custom properties being disabled automatically. These are not new custom properties, but we have enabled the auto custom property detection on some other new log sources.

My question is, is there a limit to the number of custom properties you should have in QRadar or any guidelines for how to avoid ones from being disabled?

Thanks,

Tim

This appears to be related to the max TCP payload length, we had increased it to 32,000 for a specific log source. Once we lowered it back to 16,000 the performance degradation errors went away.