I am running this query to pull the “not responding” from message. And linux message file is already rotated. so I have to look under the /var/log.
lines whose (it contains “not responding”) of files whose(name of it starts with “messages” ) of folders “/var/log”
but I am getting "The query running time exceeded the allowed time. "…
Any parameter to tweak it get the response back for scenario like this where search takes longer?
Are any of the files under “/var/log” locked in any way?
I know that one thing I’ve had trouble with is using BigFix to read the current “BigFix Client Log File” because the BES Client has it locked.
Could this result in your “exceeded allowed time” message?
nah, they are not locked. What I have noticed is that the query default timeout is 60sec for bigfixadmin(master user) but for non master user its 10sec. The query takes longer to run if there are multiple “message” files, and if file size is large > 50M
so we added this setting that works.
[Software\BigFix\EnterpriseClient\Settings\Client_BESClient_Query_NMOMaxQueryTime]
value = 120
effective date = Wed,%2029%20Aug%202018%2014:25:50%20-0400
_BESClient_Query_NMOMaxQueryTime
This setting determines how long the QnA can process a query submitted by a Non Master
Operator before stopping, discarding the request and responding to the agent that the request
could not be completed because the maximum processing time has elapsed. (default is 10sec for non master )
_BESClient_Query_MOMaxQueryTime
This setting determines how long the QnA can process a query submitted by a Master Operator
before stopping, discarding the request and responding to the agent that the request could not be
completed because the maximum processing time has elapsed. ( default is 60sec for master)