Skip to content
  • There are no suggestions because the search field is empty.

How to disable Memory Threshold for ESA Rules on 11.5 and later version

Issue

Since you have upgraded to 11.5 and later version. You can see new "Memory Threshold" setting when creating ESA Rules. Refer to the following screenshots. 

User-added

User-added

Also, You can refer to the following document about "Memory Threshold" setting. 
#######
https://community.rsa.com/docs/DOC-80065

Memory Threshold:
(This option applies to version 11.5 and later.) The maximum memory usage allowed for this rule in MB. Add Memory Thresholds to ESA rules that use memory. For example, if a rule contains windows or pattern matching, configure a memory threshold for that rule. If the configured memory threshold is exceeded, it gets disabled individually and an error is displayed for that rule on the (Configure) > ESA Rules > Services tab.
New rules default to a 100 MB memory threshold. Rules that existed before version 11.5 do not have a default value and a memory threshold is not set.
#######

In some cases if customer wants to disable this setting, currently there is no comment on document for this.

Resolution

Any new rule will have a default memory threshold of 100 MB, but it can be disabled by setting the threshold value to "0" or blanked out.

User-added

Product Details

RSA Product Set: NetWitness Platform
RSA Product/Service Type: ESA
RSA Version/Condition: 11.5 and later version

Approval Reviewer Queue

RSA NetWitness Suite Approval Queue