How to increase active consumers for any collection method in RSA NetWitness Platform

Issue

When Collector receiving huge incoming from an event source, Collection queue will have messages pending as below.
 

The above output shows file collection has too many files to process by consumer.

Cause

This issue occurs when high incoming from event sources. One consumer may not be sufficient to process the high incoming events.

Resolution

Please follow the below steps to increase the consumer count.

1. Please navigate to Log Collector->Explore view.
2. Expand event-processors->logdecoder->eventsources->queue.
3. Select Collection method which has pending messages.
4. On the right-hand side locate max_receivers and change the value from 1 to higher.
   Note: max_receivers 10 would be a better number if high incoming is there. There may be other collection methods come up with pending messages due to less consumers during the same time. Please increase max_receivers using the same steps. 
5. Post increasing, max_receivers, Please verify using the below command. The output shows consumers changed to 10 and pending messages count reduced to lower to earlier.

 

Notes

Note: Investigate the cause for high incoming By filtering query device.ip with a huge count. Check with the device owner if the log traffic can be corrected. If traffic is genuine, Collector EPS crossing desired level. Please Normalise the traffic by deploying additional Collector.

Once Traffic is normal, Please revert changes to set consumer as 1 as previously.

Product Details

RSA Product Set: NetWitness Platform
RSA Product/Service Type: Core Appliance
RSA Version/Condition: 11.X
Platform: CentOS
O/S Version: 7

Summary

This document outlines the procedure to increase the consumers for Collection.

Approval Reviewer Queue

RSA NetWitness Suite Approval Queue