Default Summary is very slow in ESM

[cmperez]

Hi

Before we upgrade to 11.3.2, were able to filter or sort some IP's on the default summary fast and easily to view. but after the upgrade  it turns to slow. May we know what are the possible cause why on the default summary is very slow when drilling down the data but on the normalized dashboard is very fast after we upgrade to 11.3.2. 

Thanks!

[yaz]

Hi @cmperez

Thanks for reaching out to community.

Based on the request, it looks like issue is seen ESM.

Moving this post to Network Security channel.

[pbpillai · Accepted solution]

Hi @cmperez,

There is an additional parameter that has to be added in the following file for 11.3.0 (After Patch 12) & 11.3.2 versions. The queries will be slow if the parameter is not added.

The fix will be available in 11.3.2 HF3.

vi /usr/local/ess/CPConsoleServer.cfg

add this line at the end:

telemetryDebug=1

Then save and quit using :wq!

After the above step, the cpservice has to be restarted using the command 'service cpservice restart'.

The above changes need to be performed on both the Management & Replica node ESM.

Please contact McAfee Technical Support for making any changes via the CLI as CLI commands on SIEM require supervision by Technical Support.

Please also refer the below KB article, that will make the Default Summary view faster by removing the baseline averages.

KB93451

https://kc.mcafee.com/agent/index?page=content&id=KB93451

Regards,

Prashanth B Pillai

McAfee Technical Support

Customer Success Group