"[PA AppSec] Daily Data Collection completed with warning" daily email to ServiceNow admin account

[Saritha6]

I got an email in my SNow admin email account with subject "[PA AppSec] Daily Data Collection completed with error". I found the PA job log and filtered for Level = error and got the error below. PDFs, screenshots attached. 

Does anyone have any idea what could have generated this or where I should look to find more information? Thanks in advance for any help!

Job Name: [PA AppSec] Daily Data Collection
Run time: 4 Seconds
Inserts: 126
Deletes: 0
Warnings: 3
Errors: 0

<a id="snc_notification_unsubscribe" href="mailto:XXX@XXX.com?subject=Unsubscribe from &quot;PA collection job with warning&quot;&amp;body=Sending this email with the predefined content in the subject and body will unsubscribe you from the notification &quot;PA collection job with warning&quot;%0D%0A%0D%0AUnsubscribe:{&quot;id&quot;:&quot;2c22d032d7321100fa6c0c12ce610367&quot;,&quot;token&quot;:&quot;c797e62132&quot;}">Unsubscribe</a> | https://XXX@XXX.com/nav_to.do?uri=notification_preferences.do%3Fsysparm_notification=2c22d032d732110...

Ref:MSG3435774_SiylxWZX9RETlYZDd1jd

[Saurav11]

Hello,

If you go in the Schedules Jobs, you will see that "[PA AppSec] Daily Data Collection" that is running daily (every hour) to collect data for some indicators.  You may see all these indicators in that job (failed logins, locked out users, etc...).

This data is used by the Instance Security Center.

Such collection will always give a warning if it tries to collect more than 5000 snapshots.  The scores are well collected, but the snapshots are then limited to 5000 records.  That's fine and usually it is best not to increase that number.  It is rare that someone looking at the dashboard will want to see all the records form one of the number, so 5000 is usually the good maximum.  A number may be 10,000 (the scores) but if you want to see them, you will only be presented 5,000 (the snapshots).

If it was a rare occurrence you can ignore it but if it occurs again you can try to increase the default limit.

Change the property "com.snc.pa.dc.max_row_count_indicator_source" as per your need. By default it is 5000.

Please mark my answer as correct based on Impact.