Correlation Server in Unhealthy State

[yazantaleb01]

Hello, I'm keep getting this alert at a high rate 'Correlation Server in Unhealthy State' coming from the ESA host, it's cleared automatically in (5 - 10) minutes.

There is no issue with the available resources. What exactly does this statistic (ProcessInfo/Overall Processing Status Indicator) checks for? how can find the reason behind it?

Thanks in advance.

[JohnKisner]

@yazantaleb01 The best I can tell the statistics for ProcessInfo/Overall Processing Status indicator is referring to the CPU and Memory utilization on the ESA server itself. When you are getting this alert see if you have any ESA rules that are utilizing a lot of resources. Or SSH into the ESA and run the top command to see what the CPU utilization and memory utilization is. It is possible that you have one or more ESA rules that are taking a lot of time or pulling in a lot of information and may need to be better optimized.