Concentrator/Decoder/Broker Settings
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎2014-03-25 10:38 AM
I am curious what everyones settings are at? I know it is different per company.
I am running a log hybrid and packet hybrid setup, but I am unsure what good values for settings like Database Open Files are, I assume this will increase performance.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎2014-03-25 12:53 PM
do you have any performance issue?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎2014-03-25 12:55 PM
I have been doing some testing today.
I have noticed that if I am running a report the investigator module seems to take a very long time to load.
When I look at the logs, it appears that the queries to return meta are sitting queued until the report finishes the initial query.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎2014-03-25 11:14 PM
do you mean the query queued? can you check SDK-stats, is there any query queued?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎2014-03-26 08:27 AM
With in the logs? Or is their a GUI section?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎2014-03-27 11:46 AM
explore - SDK - stats. you can find the activate queries or the queues.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎2014-03-27 12:04 PM
It appears that a ton queue and some of my reports have more intensive operations. I suspect this might be my issue. My config for this seems very low, a machine as powerful as SA should be able to handle more than the screenshot below. Is the size of my cache/max concurrent queries really low?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎2014-03-28 12:38 PM
you broker connected to how many concentrators? you can try to increase the maximum.current.queries so less will be queued.
Another thing is schedule your reports to night time so it won't affect your investigations.