The performance of QRadar really depends on several factors:
- hardware specifications of the console
- setup of the deployment (all-in-one, distributed)
- log ingestion / processing
- global rules
- running searches
Every factor can influence the performance and when all factors are affecting the console all at once, it can lead to long loading times and slow responses.
Regarding the disconnect messages: these can occur due to multiple issues. Either the client lost connection to the network or services on the console restarted. If this issue is affecting multiple clients at once, this would be a problem for the support to look at.
Original Message:
Sent: Sun August 16, 2020 09:43 AM
From: StarLink Support
Subject: QRadar performance issue
The console is slow in general, opening tabs, adding filters, previewing logs…
We also occasionally get a console error message of disconnections.
------------------------------
StarLink Support
------------------------------