IBM QRadar

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Back to discussions
Expand all | Collapse all

Sar Sentinel messages with incorrect thresholds

  • 1.  Sar Sentinel messages with incorrect thresholds

    Posted Thu May 12, 2022 10:06 AM

    7.4.2 FP2

    We have a collector with 24 CPU, but still get sar sentinel messages indicating a configured threshold of 10.8 for 1 minute

    System load over 1 minute has an average of 11.3 over the past 5 intervals, and has exceeded the configured threshold of 10.8.

    System load over 15 minutes has an average of 7.82 over the past 5 intervals, and has exceeded the configured threshold of 7.8

    System load over 5 minutes has an average of 9.004 over the past 5 intervals, and has exceeded the configured threshold of 9.0.

    What can we check if the configured threshold is correct/fix it somehow.

    It is the only collector having this issue in our deployment.



    #QRadar
    #Support
    #SupportMigration


  • 2.  RE: Sar Sentinel messages with incorrect thresholds

    Posted Tue May 24, 2022 10:10 AM

    Hi Natan,

    Without knowing the framework conditions why 7.4.2 FP2 is still in use, it is always a good option to go to a current release, for example 7.4.3FP5. In order to clarify the threshold values, i would consider a support ticket might also be helpful.

    Regards,

    Ralph



    #QRadar
    #Support
    #SupportMigration


Related Content