I would like to use 'Event Routing' functionnality to forward events to
an other correlaion engine (not Sentinel).
I am using the action 'Event Forwarder' which sends events in JSON
format in SYSLOG.
I got the following issue : I have 200 EPS in but 20 EPS out
(forwarded). The batch mode is enabled.
Is there an option to activate in a specific configuration file ?

Do you know why I got this difference ? What do you suggest to do that

FYi, it's planned to forward ~2000 EPS.

Thanks advance.


bgirault's Profile: https://forums.netiq.com/member.php?userid=2170
View this thread: https://forums.netiq.com/showthread.php?t=47577