Event Aggregation / Dupe detection: The module is capable of combining similar events into a single entry to reduce the amount of data sent to the server. Since many events contain identical information (hostname, IP address etc.), these fields are added once to the combined events and then unique fields are added in the list later. While this can greatly reduce the amount of data sent, the reconstruction of individual events is still not supported by Helix or any other enabling Syslog servers. Due to this, enabling the event aggregation may prevent alerts from triggering or cause events to be omitted from the search results. Therefore, Trellix does not recommend enabling event aggregation.
Helix load issues: When sending data to Helix, the module must send less than 500 events and the total size of the message must be less than 1 megabyte. If the module exceeds these values, the transaction will fail and some or all the data must be resent. Additionally, when a large number of connections are sent again to Helix for an extended period of time, it is possible for the system to become overloaded and the system may reject the data to be resent at the next interval. When the module resends the data, this can reduce the number of events per second the module can support.
Data loss when database or memory is full: When the module has stored the maximum number of events it is configured to keep, events are removed to accommodate new events generated by the system. The module is configured to discard the oldest events first and if using the database storage, to delete a larger batch of events. The module removes a batch of events in an attempt to reduce disk and CPU usage.
Invalid configuration TLS / SSL when streaming to syslog server: If the module is configured to send data to a syslog enabled server using an encrypted connection (TLS), the syslog enabled server however, if not configured to accept encrypted data, it will cause invalid data to be ingested by the server.