Highlighted
Super Contributor.. ejsimon Super Contributor..
Super Contributor..
108 views

ArcSight Rule appears to be greyed out and has a very small blue “ArcSight” icon over the Rule icon?

Jump to solution

I don't think the rule is running and not sure what this means and/or why it stopped running. This is a lightweight rule, but its triggered often and has heavy usage of adding to three active lists.

Thanks,

Eric

 

 

0 Likes
1 Solution

Accepted Solutions
Super Contributor.. ejsimon Super Contributor..
Super Contributor..

Re: ArcSight Rule appears to be greyed out and has a very small blue “ArcSight” icon over the Rule i

Jump to solution

It appears this was due to an incorrect filter condition in the rule which caused it to use a very large % of the CPU.   Once I corrected the rule it is now only using around  .55% of the CPU fractional time.  Using the Rules Status Dashboard was a big help.

0 Likes
2 Replies
Super Contributor.. ejsimon Super Contributor..
Super Contributor..

Re: ArcSight Rule appears to be greyed out and has a very small blue “ArcSight” icon over the Rule i

Jump to solution

Looks like I'm running into the 'rules.max.fractional.cpu' since the rule is running over 50% of the CPU fractional time.  I increased the property value to 95% and restarted the manager.  The rule ran longer but still ended getting deactivated (it hit over 97%).  This rule ran fine on my test ESM 7.0 patch 2 system, however I only have about 100 devices feeding events to it.  I'll try to rebuild the rule or try to limit what triggers on it.   

0 Likes
Super Contributor.. ejsimon Super Contributor..
Super Contributor..

Re: ArcSight Rule appears to be greyed out and has a very small blue “ArcSight” icon over the Rule i

Jump to solution

It appears this was due to an incorrect filter condition in the rule which caused it to use a very large % of the CPU.   Once I corrected the rule it is now only using around  .55% of the CPU fractional time.  Using the Rules Status Dashboard was a big help.

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.