Sessions Dropped Due to "Resource Unavailable" Error
Focus
Focus
Next-Generation Firewall

Sessions Dropped Due to "Resource Unavailable" Error

Table of Contents

Sessions Dropped Due to "Resource Unavailable" Error

Incident Code
INC_NGFW_RESOURCES_UNAVAILABLE_SESSION_END
Severity
Warning
Category
Device
Subcategory
System Resources
Description
This alert indicates that sessions were terminated due to resources being exhausted such as in Content and Threat Detection (CTD) and others.
Raise Condition
In Traffic logs(SLS) when we detect anomalous rise in session failure due to [ Session End Reason = 'resources-unavailable' ] in 15 minutes A minimum threshold of 100 sessions should fail before raising this incident OR we should have a moving average baseline of sessions failing with this reason and the anomaly detection should be beyond the moving average
Clear Condition
When there is no more Anomalous detection for session failure with resource unavailable for 4 hours