IBM QRadar

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only

  • 1.  TrafficAnalysis

    Posted 04/12/23 08:05 AM

    Hi, everybody! I'm trying to understand the diagnostical tools in /opt/qradar/support/.
    Especially I'm very interesting in jmx.sh and attribute meaning for java beans in qradar.

    If I'm trying to view "com.eventgnosis:type=EC Queues,name=TrafficAnalysis1/TrafficAnalysis" bean using the script above, I see next output:

    com.eventgnosis:type=EC Queues,name=TrafficAnalysis1/TrafficAnalysis
    --------------------------------------------------------------------
    EventsPosted: 402138
    Size: 0
    TotalDropped: 0
    PotentialWaits: 0
    TotalDroppedInLastInterval: 0
    Empty: true
    Full: false
    TotalPassed: 402138
    LastPassedTime: 1681300195500
    Capacity: 5000

    I also found that jmx.sh can set new values to bean's attributes (in official help -s attribute). 

    Does anybody have experience in tuning such attributes in terms of increasing performance capabilities?
    Can I tune capacity attribute? 



    ------------------------------
    Bohdan
    ------------------------------


  • 2.  RE: TrafficAnalysis

    Posted 04/12/23 05:12 PM

    Mbean changes are not persisted through service restarts, so any change would be flatted on the next service restart.

    These types of changes are not supported methods of tuning. So, attempting to set values in this way can potentially put you in a state where we'd need to rebuild if anything broke or you might put yourself in a situation were we cannot assist due to the unsupported configuration change. 



    ------------------------------
    Jonathan Pechta
    QRadar Support Content Lead
    Support forums: ibm.biz/qradarforums
    jonathan.pechta1@ibm.com
    ------------------------------