2 Replies Latest reply on Mar 29, 2017 8:31 AM by xded

    Error Log ERC: Health monitor internal Alert

    xded

      Hi Guys,

       

      has some this Errorlog message in the ERC Log?

       

      "Health monitor internal Alert. The Receiver is significantly behind in processing data."

       

      And can someone explain what the trashhold for this error is?

        • 1. Re: Error Log ERC: Health monitor internal Alert
          alssharma

          Hi xded,

           

          I observed same issue when ESM went faulty and new RMA took some time to install. There were logs in GBs pending for receiver.

           

          That message usually means the receiver is playing catchup because you possibly have one or more datasource(s) hammering the receiver.  Log into the receiver and run "cd /var/log/data/inline/thirdparty.logs/" and "ls -ltr" you should see the directories for your datasources. Run "du -shx *" and see if there are any directories with a high volume of data underneath. From there you can find the matching host/IP in "cat /etc/NitroGuard/thirdparty.conf".

           

          Check this thread https://community.mcafee.com/message/369082?tstart=0#369082.

          • 2. Re: Error Log ERC: Health monitor internal Alert
            xded

            Thx for your replay. I "solved" this problem. I have migrate all Datasource from this ERC with the Failur to another one with no Datasources.

            After that i reinstall the ERC with the failur.

             

            I did that what you descripe i had more than 10 machine withe a volume over 4 GB. The support said this is the problem from custom parser but the same Datasources on the other ERC runs without a failur.

             

            But thanks for your help