Tahir,
looks like your notification has hit the performance analysis upper limit defined in advanced custom rule settings .
Increase limit to 1000 and you should be fine. Impact will be none.
------------------------------
[Karl] [Jaeger] [Business Partner]
[QRadar Specialist]
[pro4bizz]
[Karlsruhe] [Germany]
[4972190981722]
------------------------------
Original Message:
Sent: Tue March 21, 2023 03:54 AM
From: Tahir Yagubov
Subject: SAR Monitoring Report for I/O requests
Hello,
We continuously receive the following email from QRadar:
"Average time in ms for I/O requests for device sda5 has an average of 623.3 over the past 5 intervals, and has exceeded the configured threshold of 500.0. To resolve: If your system continues to exhibit this behavior, please contact Customer Support."
Can you please clarify the reason of this notification? Can we increase the configured threshold (500.0)? Will there be any impact of increasing this threshold?
How can we resolve the issue?
------------------------------
Tahir Yagubov
------------------------------