Created on 10-17-2016 06:49 AM Edited on 05-26-2022 06:52 AM By Anonymous
Description
This article is to provide you some tweaks to adjust WMI event pulling. This will assist you in event pulling if your network latency between AO and the remote Windows Server is fast. If it is slow, then we do not suggest performing the tweaks until you have latency at nominal level (ideally x < 1ms).
1- Verify in your Credentials Tab that WMI pull intervals are at 1 minute, if not -- change it
A - After making the change Discover the Windows Server for the configuration to take effect.
B - If your pulling interval at 1 minute stops you from being able to properly pull events, move it up to 2 minutes
1 - Log into your Accelops VM that will be performing the Event pull (Super / Worker / Collectors) via SSH
2 - Edit /opt/phoenix/config/phoenix_config.txt
3 - Comment out the following line:
max_num_active_wmi_agent_thread=5
NOTE: there is 2 lines, 1 with a value of 5, 1 with a value of 10. ONLY COMMENT OUT the value with 5!
4 - Save the file
5 - killall -9 phParser phAgentManager phPerfMonitor
This will now take effect
Upgraded version to 4.2.3 will be affected by both parts
New Full 4.2.3 installs will _NOT_ be affected
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.