Getting "[PA AppSec] Daily Data Collection completed with warning" emails ever since updating from Quebec to San Diego

[Jeremy Dean]

We are getting "[PA AppSec] Daily Data Collection completed with warning" emails hourly ever since updating from Quebec to San Diego.

Reviewing the job logs, I see a warning:
Not saving all records for Indicator:f83563cab7721010aed8e6e5de11a96b Result has 7,832 records. Only allowed subset of 5,000 records are stored

Searching around on the issue I found this article "[PA AppSec] Daily Data Collection completed with warning" daily email to ServiceNow admin account s... which indicates you can adjust the system property "com.snc.pa.dc.max_row_count_indicator_source" to include as many records as you need. I updated the number to 50,000 and that seems to have stopped the error in our Pre-Prod instance, but the same change was not successful in Dev. And evn if it were, I would still like to understand:

• What does this message mean? (The error Not saving all records for Indicator...)
• What does this job do? ([PA AppSec] Daily Data Collection completed with warning)
• Why did this start when we upgraded to San Diego
• What is the proper resolution (I don't like the idea of randomly increasing numbers on system variables.)
  
  

Any help is most appreciated - thank you!

[Jim Wright3]

@Adam Stout 

That sys_id takes us to the Active Users indicator, which is read only. How can we resolve this if we cannot change the Collect Records option?

[Jeremy Dean]

Thanks Adam - that makes sense - I will do that now.

[jfrancione]

Adam, I realize that your accepted response was done several months ago, but I am just getting around to looking at this issue .  I understand your recommendation, however when I go to the pa_indicator  for the sys_id which is causing the warnings, I am unable to disable the "Collect Records" option (it is read only) thanks for any assistance.  Prior to attempting, I did elevate my roles to security_admin

[Bert_c1]

Hi jfrancione, the pa_indicators table has ACL for 'write' that require a role from: pa_data_collector, pa_admin, pa_power_user OOB. Along with a script condition, try to disable the "Collect Records"  with a user account with one of those roles.

[Adam Stout]

You may need to put in a case with Support.  The App Sec indicators may be protected if they are used by the Instance Security Center