返回
-
标题
AD Queries take more than 15 minutes to be collected -
说明
AD Queries takes unusually long to be collected by the Agent causing the display interval in the Client to be about 20 minutes. -
原因
This is due to the de-duplication functionality which is set by default to 15 minutes.
During this period, AD Queries will be hold in the Agent to compare to incoming new ones
Every identical query will be dropped to avoid noise and after that interval, the Event will be sent to Coordinator and displayed in the Client
-
解决办法
Workaround
This comportment is explained here
It is possible to tweak the interval to reduce it but this might increase significantly the Event count
- The settings are in Administration task | Configuration | Agent | "Configurations..." button
- Highlight the Configuration assigned to the Agent
- Then go to Ad Query
- Set Discard duplicate queries occurring within x minutes to the desired value