You must either reduce the number of events the agent sends to the manager, or there are additional events you need the agent to send to the manager.
To change the events the DCS agent sends to the manager you must modify the Log Rules in the Prevention or Detection Config deployed to the agent.
To modify the Log Rules:
In the DCS: Server Console go to Configs.
Go to Prevention or Detection depending on the Config you must modify.
Navigate the Workspace Folders to the location of the Config you must modify and double-click the Config.
Go to the Log Rules tab.
Add/Modify the Log Rule to be applied to this config.
Click OK in the Parameters window.
Apply/Reapply the Config to the agent(s)
Note:Before deploying to multiple agents test the behavior with one. With the change in the number of events the Manager must process, performance may change significantly depending on other settings in your environment.
For more information about agent log files read the SDCSSA Administration Guide.
Imported Document ID: TECH228922
Subscribing will provide email updates when this Article is updated. Login is required.