Documentation Center
AlienVault® USM Appliance™

Forwarding: Configurable Retries and Timeouts

Version: 5.3 and later
Deployment: All deployments

The release of AlienVault USM Appliance version 5.3 provides the capability to tune the forwarding of events and alarms. The feature is applicable to Federation deployments as well as environments where alarm and/or event forwarding is enabled. For the majority of deployments, the default setting for this forwarding parameter will suffice. However for high load environments, tuning this parameter may improve the overall reliability of alarm and/or event forwarding.

To tune forwarding, the administrator can now adjust the MAX_RETRIES parameter, which limits the number of retries for forwarding events and alarms. This MAX_RETRIES value can be adjusted to any value between 0 and 20 (Default: 10). Values outside of this range will be reconfigured accordingly to either 0 or 20.

To modify the MAX_RETRIES parameter, one will need to launch the AlienVault Setup menu (through SSH). Navigate through the menus as follows:

System Preferences > Configure Network > Alarm and Event Forwarding > Enter retry attempts

From here, the MAX_RETRIES setting can be adjusted as shown below:

MAX_RETRIES setting menu from Alarm and Event Forwarding in USM version 5.3

Once the parameter has been updated, return back to the main AlienVault Setup menu. Select Apply all Changes and on the next screen, review and confirm the change by selecting Yes as shown below:

Apply All Changes dialog in the AlienVault USM version 5.3 Setup menu

Finally, it is also worth noting that the RETRY_DELAY setting has also been modified in this release. Previously, the value for RETRY_DELAY was fixed to 1 second. In this release of the USM Appliance, the RETRY_DELAY parameter is a geometric progression that increments on each retry event. This modification should also serve to further improve the reliability of forwarding.