IBM Security QRadar

 View Only
Expand all | Collapse all

SAR Monitoring Report for I/O requests

  • 1.  SAR Monitoring Report for I/O requests

    Posted Tue March 21, 2023 03:54 AM

    Hello,

    We continuously receive the following email from QRadar:
    "Average time in ms for I/O requests for device sda5 has an average of 623.3 over the past 5 intervals, and has exceeded the configured threshold of 500.0. To resolve: If your system continues to exhibit this behavior, please contact Customer Support."

    Can you please clarify the reason of this notification? Can we increase the configured threshold (500.0)? Will there be any impact of increasing this threshold?

    How can we resolve the issue?



    ------------------------------
    Tahir Yagubov
    ------------------------------


  • 2.  RE: SAR Monitoring Report for I/O requests

    IBM Champion
    Posted Thu March 23, 2023 12:54 PM

    Tahir,

    looks like your notification has hit the performance analysis upper limit defined in advanced custom rule settings .

    Increase limit to 1000 and you should be fine. Impact will be none.



    ------------------------------
    [Karl] [Jaeger] [Business Partner]
    [QRadar Specialist]
    [pro4bizz]
    [Karlsruhe] [Germany]
    [4972190981722]
    ------------------------------