Infinity log ingestion rate has suddenly and dramatically increased for AM 'event type update'

[LazarusG]

Hi

We have a customer who is receiving emails from Checkpoint that their log ingestion rate is exceeding 50Gb and that they need to buy more storage.

This started from December - the log ingestion graph shows a flat line of nothing and then it explodes.

The customer is unaware of any changes in the environment.

It references two SK;

SK181096 - How to optimize cloud logs

SK182394 - Cloud log analytic & logging - ingestion/Retention solution.

For the second SK I'm not sure that customers have access to the product catalog(?)

For the first SK we followed the steps to identify the logs with a view to tuning the policy.

However when we filter as described we find that the logs are 100% Low Severity, 98.5% Event type update, 70.63% anti malware blade.

As such there is no matching rule so we cant follow the advice in the SK, we cant see how to prevent this log type from being ingested - does anyone have any ideas?

They are on E88.32.2003.

Thanks!

[Peter_Lyndley]

yes, i will second that... starting about a week ago , we also started seeing this on some of our customers too. Sorry i dont have an answer for you.

[LazarusG]

thanks for confirming! nice to know its not isolated - well its not 'nice' its happening elsewhere but its at least a sanity check 🙂

[Wolfgang]

We see exact the same this behavior. No change of the logs since a year, but now these messages. Something changed in the background ?

[PhoneBoy · Accepted solution]

As a bit of background, EPMaaS tenants have a limit on the amount of logs that are allowed to be ingested.
We do not enforce these limits currently, but are expecting to start doing so by the end of Q1.
This is why you are starting to see notifications about it in Infinity Portal.
This is not 100% finalized, so the details might change.

More relevant to the accuracy of the notification itself, it appears (per TAC) the ingestion volume does not seem to be calculating correctly on all tenants.
This is under investigation.

[Wolfgang]

We see this not not only for EPMaaS customer. Some Smart1-cloud tenants have the same behavior.

[PhoneBoy]

While I heard about this in the context of EPMaaS customers, Smart-1 Cloud customers also have similar limits that I assume will be enforced in the near future.

[the_rock]

The page to check log usage definitely looks different in the portal now.

Andy

[the_rock]

Noticed the same for 2 S1C cloud clients as well.

Andy

[the_rock]

Noticed that as well in the portal for few customers.

Andy