FortiSIEM
FortiSIEM provides Security Information and Event Management (SIEM) and User and Entity Behavior Analytics (UEBA)
Andy_G
Staff
Staff
Article Id 198280

Description

This article is to provide you some tweaks to adjust WMI event pulling.  This will assist you in event pulling if your network latency between AO and the remote Windows Server is fast.  If it is slow, then we do not suggest performing the tweaks until you have latency at  nominal level (ideally x < 1ms).

 

WMI Pulling Interval

Part 1

1- Verify in your Credentials Tab that WMI pull intervals are at 1 minute, if not -- change it

A - After making the change Discover the Windows Server for the configuration to take effect.

B - If your pulling interval at 1 minute stops you from being able to properly pull events, move it up to 2 minutes

 

Increase WMI Thread

Part 2

1 - Log into your Accelops VM that will be performing the Event pull (Super / Worker / Collectors) via SSH

2 - Edit /opt/phoenix/config/phoenix_config.txt

3 - Comment out the following line:

max_num_active_wmi_agent_thread=5

NOTE: there is 2 lines, 1 with a value of 5, 1 with a value of 10.  ONLY COMMENT OUT the value with 5!

4 - Save the file

5 - killall -9 phParser phAgentManager phPerfMonitor

This will now take effect

 

Version Affected

Upgraded version to 4.2.3 will be affected by both parts

New Full 4.2.3 installs will _NOT_ be affected

 

Contributors