Rule Verification

It is possible to create syntactically valid rules that return confusing or meaningless alerts. For example, you could create a syntactically valid rule to trigger an alert if CPU usage is below 101%, but this rule would not return useful alerts (since it would alert you constantly).

Always verify your rules to ensure that they return meaningful values, to help you best detect problems and issues.

Note: Custom Polling Intervals: ArcSight Management Center uses three polling intervals (4 hours, 1 day, and 1 week) associated with metric data archive types across ArcSight products. These intervals can be adjusted for proper usage, if required.

It is strongly recommended that you adjust these intervals only if you fully understand the impact of the changes.

Polling intervals can be specified in the file logger.properties using a text editor.

  • 4-hour data (minimum allowed interval 1 minute):

    monitoring.data.poll.4hour.cron=10 0/3 * * * ?

    This property indicates a poll at 3 minute intervals.

  • 1-day data (minimum allowed interval 5 minutes):

    monitoring.data.poll.1day.cron=15 0/10 * * * ?

    This property indicates a poll at 10 minute intervals.

  • 1-week data (minimum allowed interval 1 hour):

    monitoring.data.poll.1week.cron=20 2 */2 * * ?

    This property indicates a poll at 2 hour intervals.

After making the changes and saving the edited file, a server restart is required for the changes to take effect.