Question & Answer
How do you tune the QSize parameter?
The QSize parameter sets the maximum size of a monitor's event queue on disk. Warning messages like the following in the monitor log indicate that you need to increase the QSize:
Queue X full, event from Y is lost!
The guidelines state that the best setting for QSize is 10 MB for most situations (10 * 1024 * 1024 = 10485760 bytes). In larger environments, increase this value for each monitor by 1 MB ( 1024 * 1024 = 1048576 bytes) per 1000 elements.
For the monitors, the default QSize is set to 1024000 bytes. This value is deliberately set to a lower initial value -- just under 1 MB.
The default bridge QSize is higher than the monitor QSize, since all monitor events have to go through the bridge. By default the bridge QSize is initially set to 51200000 bytes. This value is a little less than 50MB (1024 * 1024 * 50 = 52428800 bytes).
If the QSize for the other monitors is being increased then increase the bridge QSize. The amount of increase depends on the total number of elements being processed by all monitors. Set a bridge QSize of between 30MB and 100MB.
To change the QSize parameter, edit the .props file for the bridge, kisagent, or monitor. Then, restart the ISM agent.
The .props files reside in the following directory:
17 June 2018