Blocking frequent events

This section provides information about managing frequent events blocking, about removing blocking of frequent events, and about exporting the list of frequent events to a file.

About blocking frequent events

A managed application, for example, Kaspersky Endpoint Security for Windows, installed on a single or several managed devices can send a lot of events of the same type to the Administration Server. Receiving frequent events may overload the Administration Server database and overwrite other events. Administration Server starts blocking the most frequent events when the number of all the received events exceeds the specified limit for the database.

Administration Server blocks the frequent events from receiving automatically. You cannot block the frequent events yourself, or choose which events to block.

If you want to find out if an event is blocked, you can check if this event is present in the Blocking frequent events section of the Administration Server properties. If the event is blocked, you can do the following:

• If you want to prevent overwriting the database, you can continue blocking such type of events from receiving.
• If you want, for example, to find the reason of sending the frequent events to the Administration Server, you can unblock frequent events and continue receiving the events of this type anyway.
• If you want to continue receiving the frequent events until they become blocked again, you can remove from blocking the frequent events.

Managing frequent events blocking

Administration Server automatically blocks the receiving of frequent events, but you can stop blocking and continue to receive frequent events. You can also block receiving frequent events that you unblocked before.

To manage frequent events blocking:

1. In the Kaspersky Security Center console tree, open the context menu of the Administration Server folder, and then select Properties.
2. In the Administration Server properties window, go to the Sections pane, and then select Blocking frequent events.
3. In the Blocking frequent events section:
   • Select the Event type options of the events that you want to block from being received.
   • Unselect the Event type options of the events that you want to continue receiving.
4. Click the Apply button.
5. Click the OK button.

Administration Server receives the frequent events for which you unselected the option Event type and blocks receiving frequent events for which you selected the option Event type.

Removing blocking of frequent events

You can remove blocking for frequent events and start receiving them until Administration Server blocks this type of frequent events again.

To remove blocking of frequent events:

1. In the Kaspersky Security Center console tree, open the context menu of the Administration Server folder, and then select Properties.
2. In the Administration Server properties window, go to the Sections pane, and then select Blocking frequent events.
3. In the Blocking frequent events section, click the row of the frequent event for which you want to remove blocking.
4. Click the Delete button.

The frequent event is removed from the list of the frequent events. Administration Server will receive events of this type.

Exporting a list of frequent events to a file

To export a list of frequent events to a file:

1. In the Kaspersky Security Center console tree, open the context menu of the Administration Server folder, and then select Properties.
2. In the Administration Server properties window, go to the Sections pane, and then select Blocking frequent events.
3. Click the Export to file button.
4. In the Save as window that opens, specify the path to the file to which you want to save the list.
5. Click the Save button.

All the records on the frequent events list are exported to a file.