Question & Answer
Question
How can you increase QRadar Syslog Event Timeout threshold?
Cause
Log Sources that have not received an event within the last 720 minutes, display the following error in the Log Source Summary page:
Answer
To increase the Syslog Event Timeout threshold.
- Log in to the QRadar Console.
- On the navigation menu (
), click Admin > System Settings > Advanced > Syslog Event Timeout (minutes): - Enter in a new threshold, click Save.
The message "Changes have been saved successfully. Please deploy." is displayed.
- Close the System Settings window.
- Click Deploy Changes.
Note: IBM Security QRadar on Cloud users need to open a support ticket with the IBM QRadar support team to increase this value as they do not have access to these settings.
[{"Product":{"code":"SSBQAC","label":"IBM QRadar SIEM"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"Events","Platform":[{"code":"PF016","label":"Linux"}],"Version":"Version Independent","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]
Was this topic helpful?
Document Information
Modified date:
15 February 2023
UID
swg21991768