Starting with JSA 7.3 version and later, the JSA UI shows system notification messages, which are basically the same as the logs in /var/log/qradar.log . These are shown in the UI for information and troubleshooting purposes.
/var/log/qradar.log
However, sometimes these system logs can get overwhelming and we may need to reduce the number of events reported in Event Viewer. This article shows how this is done.
I want to reduce the number of system notifications displayed in Event Viewer.
System Notifications are shown in the Event Viewer based on the "System Notification" rule. This rule can be modified as required to reduce the number of messages displayed in the Event Viewer.
Perform the following steps to tune the "system notification" rule.
Log in to JSA by using the WebUI.
Go to the Offense tab > Rules.
Select the rule "System: Notification" and edit it (double-click to open the rule).
Make necessary changes to the rule. For example, the following settings will limit the system notification to 3 messages per hour:
Click Finish to save the rule.
2020-12-14: Modified article to use images from JSA 7.3 along with relevant instructions.