been having some issues with the MISP connector. It keeps crashing on large feeds after consuming extraordinary amouts of RAM.
I was pointed to this post
Specifically to the last page, where buildmodelydelay and maxeventsforebuild are specified.
After adding the above entries, seems to work better. Any body else with this experience?
i want to clarify if we are discussion about ( https://community.microfocus.com/t5/ESM-and-ESM-Express/Model-Import-Connector-for-MISP-Malware-Information-Sharing/ta-p/2752381)
What is the memory allocated for MISP Smart Connector?
to be honest it's first time when i saw those parameters so i do not have any idea if they are helping or not.
Regarding to the memory consumption i think that we are already address this on the new release based on 7.15.
Let's wait for the next release of this type of SM and see how it's behave.
Ok, will see at 7.15 version.
The parameters are supposed to reduce batching. It helped here, especially for feeds with a large number of entries. Before that, it just crashed the connector with feeds with around 300k entries.
So, when is the connector due? Is that the time that ESM 7.3 is coming out as well?
The property is from RepSM config guide..
Imported entries into Manager very low
The number of reputation data entries imported into the ArcSight Manager seems very low.
There might also be reputation data archive files that have a file extension of xml.bad in ARCSIGHT_
Make sure the following Model Import Connector for RepSM Plus property is set in the
agent.properties file located at ARCSIGHT_HOME\current\user\agent:
buildmodeldelay=60000(one minute expressed in milliseconds)
This property controls how frequently the archives are sent to the Manager. If it is set too low, the
connector will send archives too frequently. For more information about this property, see the Model
Import Connector for RepSM Plus Configuration Guide.
unfortunate i do not have release dates for SM 7.15 or ESM 7.2.1 but everyone it's expecting that will gonna happen soon.