You can set the upper and lower limits for the event cache. When the limits are set, an alert is generated to notify that the cache is about to overflow or has recovered from overflow.
Command
Description
sadmin config set EventCacheWMHigh=<value>
This command sets an upper limit.
Include a value for the
EventCacheWMHigh parameter. The specified value for this parameter should be between 50% to 100% of the event cache size.
sadmin config set EventCacheWMLow=<value>
This command sets a lower limit.
Include a value for the
EventCacheWMLow parameter. The specified value for this parameter should be above 20% of the event cache size. The value of the low watermark level must always be less than the value of the high watermark level.
Application Control and Change Control > Application and Change Control 6.x > Trellix Application and Change Control 6.5.x - Linux Product Guide > Maintaining your system in an unmanaged environment > Review changes using events
Application Control and Change Control > Application and Change Control 6.x > Trellix Application and Change Control 6.6.x - Linux Product Guide > Maintaining your systems > Maintaining your system in an unmanaged environment > Review changes using events
Application Control and Change Control > Application and Change Control 8.x > Trellix Application and Change Control 8.4.x - Windows Product Guide > Maintaining your systems > Maintaining your system in an unmanaged environment > Review changes using events