Security Compliance
Setting a rule in the Response Time window for more than 24 hours in SEM causes rules to fail
This article provides information about exceeding the Response Time value of 24 hours in the correlation section of the SEM rule builder.
First published date
Last published date
Overview
This article provides information about exceeding the Response Time value of 24 hours in the correlation section of the Security Event Manager (formerly Log & event Manager) rule builder.
Example: Agents that are disconnected for more than 24 hours do not trigger any rules within SEM when they are reconnected.
Product section
Resolution
Agents that are disconnected for more than 24 hours do not trigger any rules within SEM after they are reconnected. This is because the events the agent sends back to the SEM manager are older than the set 24 hour real-time limit in the rules.
Unfortunately, it is not possible to extend the limit beyond 24 hours.
IMPORTANT: Having a response time value set to 24 hours can also cause performance issues, as the longer the rule is waiting for the conditions in a rule to be met, the more logs are gathered taking up more space. SolarWinds recommends setting the Response Time value to less than 24 hours.
Contact SolarWinds Technical Support for more information.