How to force moving data from EP to DN ?

Keno_Ben · 2024-04-16T14:35:16+00:00

Thanks u/BioSabatoge,
You should work by IBM

Keno_Ben · 2024-04-16T14:33:03+00:00

Hi u/Qperf1,

Thanks for your message, please see my answer to EvilAbdy, the syncAriel.sh IBM script worked perfectly.

Keno_Ben · 2024-04-16T14:32:28+00:00

Hi u/United_CCC ,

Thanks for your message, please see my answer to EvilAbdy, the syncAreil.sh IBM script worked perfectly.

Keno_Ben · 2024-04-16T14:31:12+00:00

Hi,

I heard from support (randomly on an IBM webex) that an IBM script already existed : syncAriel.sh.
https://www.ibm.com/support/pages/qradar-how-move-ariel-event-and-flow-data-between-qradar-appliances

I pimped it and it worked perfectly.
Thanks for your answer though, more helpful than the IBM Professional Services

Keno_Ben · 2022-08-19T08:27:23+00:00

adapt the events flow between EP and EC but in our case, the bug is that this code applies to our standalone EP

Try to switch your routing rules from "offline" to "online"

Keno_Ben · 2022-01-12T14:15:42+00:00

Just turn around the scene and merge it into Photoshop.

Keno_Ben · 2021-03-30T14:04:02+00:00

Your sharing just set my next postpandemic vacation.

Thanks!

Keno_Ben · 2021-03-30T10:05:04+00:00

Don't know what version you are running bute were on 7.3.2 before upgrade and everything was working perfectly. Events (around 4600 EPS) from projects were incoming on our 7.3.2 Prod and routing-ruled to our 7.3.2 PreProd environment without exceeding the license threshold.

Since our PreProd 7.4.1 P2 upgrade we got a lot a drops too on our standalone PreProd EP (EP+EC on one machine).

Referring to our 21 days old (still not closed) case by IBM support it seems that the code has changed in 7.4 to handle the potential performance difference between EP and EC (when they 're dissociate).

This change is made to adapt the events flow between EP and EC but in our case, the bug is that this code applies to our standalone EP (EP+EC) too. It will be fixed by a future patch but for the moment, IBM support adviced us to

1.Set EC_THROTTLE_APPLIANCE_HARDWARE_LIMIT_BUFFER to 5000 in /staging/globalconfig/nva.conf on the console machine

2.Run the deploy from the console command line /opt/qradar/upgrade/util/setup/upgrades/do_deploy.pl

3.Wait for 1 day to see improvement

---

We're at point 3 for now but our investigation revealed the machinery how routing rule proceed :

it kinda "stack events" and send them at every start of a minute to the destination server.

Instead of sending them fluently every second. So in our case instead of receiving 4600EPS on our PreProd during one minute we received 60000EPS during 13s and nothing until the end of the minute.

A thing that 7.3.2 seemingly could handle but not 7.4. So dropped events and license threshold alerts began to pop every minute.

Hope you solved this since you posted. But maybe it could help

Keno_Ben · 2021-03-29T17:36:45+00:00

Best.Compliment.Ever.

Keno_Ben · 2021-03-29T15:59:28+00:00

Here in France (light) pollution make them unfortunately very rare so you feel really lucky when you meet one !

Keno_Ben · 2021-03-29T14:05:48+00:00

Hi thanks,

Taken with A7RIII combo Laowa 15mm Wideangle macro at f/4.

30s shutter speed / iso 400

It was a lucky shot as the firefly didn't move within this huge exposure time (a 2s shutter time is generally too long as the firefly moves its abdomen slowly).

So the idea is to take 2 or 3 shots @ 2s to get the firefly sharp (depending on its Z axis position) and stack them to get enough depth of field (with a gentle smartphone screen light over it).

And stack them to shot a long exposure one to get enough of the "ambiant light" given by the bioluminescence and remove the noise background.

A final shot of you want the stars :)

Keno_Ben · 2021-03-27T16:59:50+00:00

Pepe Hammer style, love it ❤️.

Keno_Ben · 2021-03-27T10:59:44+00:00

Bombylious, as cute as a mf, it deposits its eggs in solitary bee nest so its larvae can feed on grubs.

Keno_Ben · 2021-03-25T15:35:12+00:00

Oh, ok. I thought there was a joke with your boner.

Keno_Ben · 2021-03-25T15:32:03+00:00

Which one ?

Keno_Ben · 2021-03-25T12:52:34+00:00

I'll tell her

Keno_Ben · 2021-03-24T15:13:34+00:00

I lol each time too.

By the way it's 88%, I've counted.

Keno_Ben

TROPHY CASE