Product: Flowmon ADS
In system messages appeared ads-b5f658.
|Steps to Reproduce:|
Usually this is an indication of a bad ADS configuration. The number of generated events is higher than the database can process or the database is blocked.
The expected number of events is about 1000 per day, because a huge number of events lose informative significance for the customer.
In the analysis for last 24 hours of event summary check which methods generate lot of events. Methods that generate thousands of events per day are candidates for adjustment. The optimal value is about 20 events per day for each method according to size of a monitored network.
First decide, if this method is informative for you. If not, you can stop detection in Settings -> Processing -> Methods.
For methods you want to detect, check event detail of the detection. If is it legitimate behavior in your network, you can tune method parameters or assigned filters in Settings -> Processing -> Edit instance, or you can create a false positive rule.
For DNSANOMALY and DHCPANOMALY methods we recommend defining your legitimate servers in use.