Dirscan filesize alarming even though the threshold is not breached
Article ID: 279962
Updated On:
Products
Issue/Introduction
I have set a threshold for File Size monitoring in the Driscan probe. However I'm receiving an unexpected / false alarm even though the file size is not breaching the threshold.
Environment
DX UIM any version
dirscan any version
Cause
Working as designed
Resolution
The probe is working as expected. The comparison operator for file size threshold is not like other operators for other probes, like for example CDM CPU monitor, where the alarm is expected if a threshold is breached.
With dirscan filesize, we are telling the probe what to expect. If the expectation is not met, then the alarm is generated. In fact the alarm say so "Expected..."
It means that the expectation is that the file size is as we defined, if that condition is NOT met, alarm is raised.
Here is how it should work:
1. you have a file in a dir that is 5.x GB:
2. If you want an alarm when this file is bigger than 4 GB, you should set the threshold "expect file to be smaller or equal to 4GB" and not the opposite as you might be doing.
3. See the alarm:
Additional Information
Feedback
