IBM Security QRadar SOAR

 View Only
  • 1.  Message Queue / Destination - No ACK option

    Posted Tue July 26, 2022 10:17 AM
    Greetings,

    I am using the no ACK option in some queues, yet, the queues still take +40 minutes to get marked as Completed if the platform is too congested.

    How does this option work? What purpose does it have, if it still waits for an ACK?

    Thanks,



    ------------------------------
    Pol Estecha
    ------------------------------


  • 2.  RE: Message Queue / Destination - No ACK option

    Posted Wed July 27, 2022 08:38 AM

    For function-based communication over a message destination, you'll want to use ACKs. This is needed for the replies to work correctly. And in the event that your Integration server or App Host container is restarted while a function is processing, the message remains queued and will be resubmitted once the app environment restarts.

    For one-way communication, such as using action-based integrations where communication with a message destination is used directly on a rule and not through a workflow, disabling ACKs can speed processing. 

    If your queues are taking over 40 minutes to process, something else is amiss. Is it possible you have many long running functions? If so, you may be running out of worker threads. Adding more threads via the num_workers setting (the default is 10) in your app.config may help:

    [resilient]
    num_workers=20



    ------------------------------
    Mark Scherfling
    ------------------------------



  • 3.  RE: Message Queue / Destination - No ACK option

    Posted Wed July 27, 2022 10:26 AM
    Edited by Pol Estecha Hernández Wed July 27, 2022 10:37 AM
    Greetings, Mark!

    Yes, we have tried with a direct action which uses no Workflow, only Rule, in specific, Data Feeder.

    Even if the action took 40 minutes to process, wouldn't the no ACK make it instantly finish, at least on Resilient end? Meaning we don't have to wait until completion/ACK to mark it as finished?

    If not, what is the purpose of no ACK?

    Our backend queue is empty and the integration takes milliseconds to complete.

    Thanks for your help!

    ------------------------------
    Pol Estecha Hernández
    ------------------------------



  • 4.  RE: Message Queue / Destination - No ACK option

    Posted Wed July 27, 2022 01:49 PM
    Greetings!

    Just an update. It seems like it was a temporal thing. No ACK works as expected now. Instantly set as completed when the rule is triggered.

    Thanks!

    ------------------------------
    Pol Estecha Hernández
    ------------------------------