Setting a reasonable Stopping Threshold Rate in TIBCO LogLogic SEM
Article ID: KB0077398
Updated On:
| Products | Versions |
|---|---|
| TIBCO LogLogic Security Event Manager | 3.x and higher |
Description
Specifying a small threshold for the Stopping Threshold Rate may not have the desired effect.
Let's suppose you set a short time value in the Stopping Threshold Rate (e.g. 10 events/2 seconds). A short time period (2 seconds for this example) may not be enough for the SEM application to process a large amount of data.
If the tenth event (within 2 seconds) is detected at time t1 but processed at t1 + 4 sec (i.e. four seconds later), due to a technical problem such as a network overload, then this event will not be considered in the group defined by the Stopping Threshold Rate.
Therefore, it is recommended to set a reasonable time value for the Stopping Threshold Rate. We do not recommend setting a time value under 10 seconds.
Issue/Introduction
This article provides advice for customizing the Stopping Threshold Rate.
Feedback
Yes
No
Powered by
