IBM Security QRadar SOAR

 View Only

High Utilisation of Loopback Interface

  • 1.  High Utilisation of Loopback Interface

    Posted Wed December 29, 2021 02:11 PM
    Hi All,

    I would like to find out if the loopback (lo) interface in the OVA versions of SOAR does have higher utilisation rates.

    For example, in the attachment (Loopback Utilisation), SolarWinds has detected the interface to have been using between 89% - 100% of its "transmitted utilisation" in our production environment.

    Doing internal monitoring in my staging environment with minimal traffic with this command: sar -n DEV 1 3 showed a higher rx/tx rate as compared to the other interfaces (Staging Loopback).

    I was just wondering if anyone out there would know or have experience in this area where:
    1) The utilisation rates generated by this loopback interface in SOAR are anything significant to take note of, and why are they much higher?
    2) Are these actually the normal utilisation rates due to a Resilient service, and so is there a recommended utilisation threshold that the loopback interface should have?

    Appreciate any help and advice for this issue!
    Thank you,

    Bingjie Ng