Threshold reached for response actions

Explanation

The custom rules engine (CRE) cannot respond to a rule because the response threshold is full.

Generic rules or a system that is tuned can generate a many response actions, especially systems with the IF-MAP option enabled. Response actions are queued. Response actions might be dropped if the queue exceeds 2000 in the event collection system (ECS) or 1000 response actions in Tomcat.

User response

• If the IF-MAP option is enabled, verify that the connection to the IF-MAP server exists and that a bandwidth problem is not causing rule response to queue in Tomcat.
• Tune your system to reduce the number of rules that are triggering.