XMA: EMS Mover does not sending of any event burst that exceeds the parameters specified on the BURSTFLT file

XMA: EMS Mover does not sending of any event burst that exceeds the parameters specified on the BURSTFLT file

Disabling the BURSTFLT file through the '2: MOVER menu -> 15: EMS Filter File' menu could resolve the issue, but fully disabling the burst filter causing too many messages to be alerted and/or sent to SIEM.
Or updating the parameters on the BURSTFLT file and restarting the EMS Mover could be an option to address the issue.

Below is example of the parameters on the BURSTFLT file.
If the burst filter is enabled and an application begin issuing the same event, e.g. TANDEM.EMS.L02        000512, (SSID 'TANDEM.EMS.L02', Event number '512'), at 2024-12-12 12:34:56;
- EMS Mover continues to collect the EMS events until the N (i.e. N 50) of the bursting event (e.g. SSID 'TANDEM.EMS.L02', Event number '512') arrives during the T1 (60 seconds) time period from 2024-12-12 12:34:56.
- EMS Mover starts supressing the 51th and subsequence of the bursting event (e.g. SSID 'TANDEM.EMS.L02', Event number '512') that arrives during the T1 (60 seconds) time period from 2024-12-12 12:34:56.
- EMS Mover ends supressing the bursting event (e.g. SSID 'TANDEM.EMS.L02', Event number '512') if no bursting event occurs during the T2 (120 seconds) time period.
- EMS Mover checks the ended bursting event (e.g. SSID 'TANDEM.EMS.L02', Event number '512') every T3 (30 seconds) time interval
- S 20: 20 is the maximum number of simultaneous bursts that the EMS Mover can detect and monitor
- L 0: The comparison byte length of the first subject value of the bursting event.

< BURSTFLT example >
?COMMENT
Burst Detection/Suppression
?SUPPRESS
! Number of event occurrences for a burst
?N 50
! Burst start detection interval (seconds)
?T1 60
! Burst end detection interval (seconds)
?T2 120
! Periodic check for burst end (seconds)
?T3 30
! Maximum number of simultaneous bursts
?S 20
! Subject length to compare
?L 0

    • Related Articles

    • XMA: How to check Mover database and Pathway parameters.

      Modified pathway and database parameters are stored in the PARAMS table. By default it is stored in the subvolume XMADAT. To confirm that default parameters for a mover have been changed and to view what the new value is: TACL> VOLUME <XYGATEMA SQL ...

    • XMA: Measure Mover Keeps Abending

      Is XYPRO SecurityOne installed? The Measure mover is not designed to collect system performance metrics. It is designed to only capture process information for the XYGATE SecurityOne WHO Resolver. The MEASURE mover collects information regarding ...

    • XMA: How to update audit file mask of a mover

      The audit file mask can not be updated. A new mover has to be added and the old mover can be deleted if desired. This applies to all the movers. If this article did not provide a solution, please open a case with our support team by sending an email ...

    • XMA: How to Change the Safeguard Mover's IGNORE READ RECORDS parameter

      By default the Safeguard mover ignores the extraneous secondary READ records for file access attempts. If you wish to change the setting: XMA_MANAGER / Mover Menu / Option 12 / Parameters Menu /Option 12: Show Read Details If set to TRUE, the ...

    • XMA: Error 72 - Mover Deadlock Condition

      To reduce the transaction size in the SLSENDER, follow these steps below: Volume to the XMA Installation Subvolume (ie. VOLUME $<VOL>.XYGATEMA) Run XMA INSTALLATION to attach the XYGATEMA segment Type: XMA_MANAGER to manage the pathway Select 2: ...