Product: Flowmon ADS
In system messages appeared ads-b5f658.
|Steps to Reproduce:|
Usually, this is an indication of a bad ADS configuration. The number of generated events is higher than the database can process or the database is blocked.
The expected number of events is about 1000 per day because a huge number of events lose informative significance for the customer.
In the analysis for last 24 hours of event summary check which methods generate lot of events. Methods that generate thousands of events per day are candidates for adjustment. The optimal value is about 20 events per day for each method according to size of a monitored network.
First decide, if this method is informative for you. If not, you can stop detection in Settings -> Processing -> Methods.
For methods you want to detect, check the event detail of the detection. If it is not legitimate behavior in your network, tune method parameters or assigned filters in Settings -> Processing -> Edit instance, or you can create a false positive rule.
For DNSANOMALY and DHCPANOMALY methods we recommend defining your legitimate servers in use.