FSSO missing user logon events in DC agent mode - "Too much request in the queue"

[James_G]

Hi all - have FSSO in DC agent mode missing logon events and producing the following error in the dcagentlog (when logging enabled). I have a call open with support, but expect the forums could beat them to the fix the speed they are returning to my issues at the moment. Anyone with any ideas?

02/25/2021 17:31:51.428: processing Logon (level=1, logonid=0-0) WINCHNT\jgXXX (James XXX) from DESKTOP-WCCJB7E

Domain:WINCHNT DNS suffix added:XXX.uk.

Too much request in the queue, discard this logon event, domain:WINCHNT, workstation:DESKTOP-WCCJB7E, user:jgXXX, request in queue:100001

02/25/2021 17:31:51.428: finish processing.

[Philippe_Gagne]

Hi,

How the configuration is done in your Fortigate? Poll Active Directory or Full Collector?

I already saw some installation where Polling was not fast enough to process all requests. 

The most stable configuration is:

DC Agent installed on all Active Directory Domain Controllers

Collector on one or two servers or AD, two is only for redundancy purpose

FSSO Agent on Windows AD configured in the Fortigate (External Connectors).

With this configuration, I saw more than 800 computers in less than 15 minutes loging on the domain.

I hope it helps! :)

Regards,

Philippe

[James_G]

I am running full DC agent and collector on each domain controller, but seems that cannot keep up.

[Philippe_Gagne]

User group source? Local or Collector Agent in the Fortigate.

In the collector: standard or advanced?

[James_G]

User group source? Local or Collector Agent in the Fortigate. --> tried both, still fails

In the collector: standard or advanced? --> tried both, still fails

[Philippe_Gagne]

Hi James,

Did you find a solution?

Is the collector runs as a Domain user that can read Security Event Log? And where the collector is installed?

Regards

[James_G]

Set "donot_resolve = 1" in the registry key of the FSSO DC agent

It can happen when the DC agent cannot resolve DNS names. Can I ask you please to follow this KB and disable DNS name lookup on DC Agent: https://kb.fortinet.com/k....do?externalID=FD37705