How To
Summary
How to I change the time that the IBM Resilient QRadar application polls for new offenses to escalate?
Objective
The polling period might need to change in some environments. This document describes how changing the polling period can be achieved.
Steps
To change the default polling time, use What information is required when engaging support with IBM QRadar/Resilient application problems? to access the container and update /store/app.config changing the polling_period to the desired number of seconds.
[qradar]
polling_period = xxx
Once the desired number of seconds are set, the application restarts and the poller runs as defined by your new value.
2020-06-11 14:14:18,717 INFO [app_restartable] Configuration file has changed! Notify components to reload
.....
2020-06-11 14:15:12,437 DEBUG [qradar_poll] Scheduling the next timer to occur in xxx seconds
Do not set the value to run more frequently than 120 seconds. In some busy deployments, the polling_period should be longer so that the poller does not start before the latest offenses are processed.Related Information
Document Location
Worldwide
[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSIP9Q","label":"IBM Security SOAR"},"ARM Category":[{"code":"a8m0z0000001gyGAAQ","label":"Integrations->QRadar app"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Version(s)","Line of Business":{"code":"LOB24","label":"Security Software"}}]
Was this topic helpful?
Document Information
Modified date:
19 April 2021
UID
ibm16226458