Troubleshooting ESM GUI performance issues

If you notice degraded performance in the user interface, try one or more of these remedies.

Set Aggregation to default with Dynamic Aggregation enabled.
1. Go to the Receiver Properties page and select Event Aggregation.
2. Make sure that the Aggregation level is set to Medium High (Default).
  Note
  Dynamic Aggregation is enabled by default in Trellix ESM 10.x and 11.x.
Run scheduled reports during off hours and stagger them so they do not run at the same time.
1. Go to ESM System Properties and select Reports.
2. Select the Enabled reports and click Edit for each report.
3. In the When do you want the report to run section, click Edit Conditions.
4. Schedule reports to run during nonpeak hours. Run reports at different times.
Verify that devices are configured with the correct DNS server.
1. From the device Properties page, click <devicce> Management.
2. Click Interface.
3. In the Interfaces area, click Setup.
4. Verify that the DNS server IP addresses are correct.
Check for processes running at 100%.
1. Connect to the Trellix ESM using SSH.
2. Enter htop at the command prompt.
  Note
  - Shift+M sorts results by memory use.
  - Shift+H shows or hides the users.
  - Shift+P sorts according to the CPU use.
  - i sets the I/O priority.
  Examine the VIRT values (total program size in memory). If the values in the VIRT column are red, collect the device data and open a service request with Trellix Technical Support.
Check for an excessive number of alarms.
1. On the System Properties page, click Alarms.
2. Use your best judgment to determine if the number of configured alarms is affecting performance. Consider factors such as number of events, types of alarms, and the cardinality of events.
Delete old triggered alarms.
1. From the navigation menu , select Alarms.
2. Right-click alarms that are no longer useful and click Delete.
Set alarms to trigger less frequently.
1. On the System Properties page, click Alarms.
2. Select an alarm and click Edit.
3. Select the Condition tab.
4. Set the Maximum Condition Trigger Frequency to a value sufficient to reduce the number of alarms to a reasonable level (at least 10 minutes).
Check for multiple Signature IDs in alarm configuration.
1. On the System Properties page, click Alarms.
2. Select an alarm and click Edit.
3. Select the Condition tab.
4. Make sure the alarm has only one Signature ID in the Values field.
Restrict insertion of historical data.
1. From the Receiver Properties page, click Events, Flows, and Logs.
2. Select Don't insert events older than x days.
3. Set the value to the lowest reasonable retention (typically 5–7 days).
Make sure future events are not being retrieved.
1. From the Receiver Properties page, select Receiver Management.
2. Click Time Delta.
3. If the Time Delta for the data sources is set to retrieve future events, open a Service Request with Trellix Technical Support to correct this issue.
Check for long-running tasks.
1. From the System Properties page, select ESM Management.
2. Select the Maintenance tab and click Task Manager.
3. Check for tasks that have been running for a long time and close them.
Disable unneeded parsing rules
1. Select a Receiver from the device tree and open the Policy Editor.
2. Click + next to Receiver.
3. Click Filter and create filters for events you don't need.
4. Click Advanced Syslog Parser and disable any rules you don't need.
5. Click Data Source and disable any rules you don't need.
Tune Trellix ESM - ACE correlation rules
1. Select the ACE from the device tree.
2. Open the Policy Editor.
3. Select Correlation.
4. Click Advanced in the lower right.
5. Set Origin to User Defined and refresh the view.
6. Double-click a rule to open it.
7. Review the rule logic for efficiency. For example, a correlation rule that has the condition "Not In (IP address list)" must search through a long list of IP addresses, which contributes to poor performance. Use the "In" condition instead.
Turn off Copy Packet
1. Select a Receiver from the device tree and open the Policy Editor.
2. Click + next to Receiver.
3. Click Advanced Syslog Parser.
4. Turn off Copy Packet for all rules.
5. Click Data Source.
6. Turn off Copy Packet for all rules.
Turn on aggregation.
1. Select a Receiver from the device tree and open the Policy Editor.
2. Click + next to Receiver.
3. Click Data Source.
4. Turn on Aggregation for all rules.