cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Default Summary is very slow in ESM

Jump to solution

Hi

Before we upgrade to 11.3.2, were able to filter or sort some IP's on the default summary fast and easily to view. but after the upgrade  it turns to slow. May we know what are the possible cause why on the default summary is very slow when drilling down the data but on the normalized dashboard is very fast after we upgrade to 11.3.2. 

Thanks!

1 Solution

Accepted Solutions
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 3 of 3

Re: Default Summary is very slow in ESM

Jump to solution

Hi @cmperez,

There is an additional parameter that has to be added in the following file for 11.3.0 (After Patch 12) & 11.3.2 versions. The queries will be slow if the parameter is not added.

The fix will be available in 11.3.2 HF3.

vi /usr/local/ess/CPConsoleServer.cfg

add this line at the end:
 
telemetryDebug=1
 
Then save and quit using :wq!
 
 
After the above step, the cpservice has to be restarted using the command 'service cpservice restart'.
 
The above changes need to be performed on both the Management & Replica node ESM.
 
Please contact McAfee Technical Support for making any changes via the CLI as CLI commands on SIEM require supervision by Technical Support.
 
Please also refer the below KB article, that will make the Default Summary view faster by removing the baseline averages.
 
 
 
Regards,
 
Prashanth B Pillai
 
McAfee Technical Support
 
Customer Success Group

View solution in original post

2 Replies
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 3

Re: Default Summary is very slow in ESM

Jump to solution

Hi @cmperez

Thanks for reaching out to community.

Based on the request, it looks like issue is seen ESM.

Moving this post to Network Security channel.

McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 3 of 3

Re: Default Summary is very slow in ESM

Jump to solution

Hi @cmperez,

There is an additional parameter that has to be added in the following file for 11.3.0 (After Patch 12) & 11.3.2 versions. The queries will be slow if the parameter is not added.

The fix will be available in 11.3.2 HF3.

vi /usr/local/ess/CPConsoleServer.cfg

add this line at the end:
 
telemetryDebug=1
 
Then save and quit using :wq!
 
 
After the above step, the cpservice has to be restarted using the command 'service cpservice restart'.
 
The above changes need to be performed on both the Management & Replica node ESM.
 
Please contact McAfee Technical Support for making any changes via the CLI as CLI commands on SIEM require supervision by Technical Support.
 
Please also refer the below KB article, that will make the Default Summary view faster by removing the baseline averages.
 
 
 
Regards,
 
Prashanth B Pillai
 
McAfee Technical Support
 
Customer Success Group

View solution in original post

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community