The new docs.trellix.com features a modernized UI and AI-powered conversational search. Content is currently available in English, with additional languages launching in early November 2026. We hope you enjoy the updated experience.

Define the threshold value for event throttling

Prev Next

The throttle threshold is a configurable parameter that limits the number of events an endpoint can send to ePO - On-prem per day. Administrators can set this value from the ePO - On-prem console to manage event flow and prevent system overload.

How is the throttle threshold calculated?

The throttle threshold is calculated as follows:

Throttle threshold = (Number of events possible to send over a long period) / (Number of days over that period)

How does the throttle threshold work?

  • The throttle threshold acts as a maximum limit for the event_send_quota value.

  • The event_send_quota value indicates the number of events that can be sent to the ePO - On-prem without throttling (that is, without caching events to disk).

  • The event_send_quota value can accumulate up to the throttle_threshold value.

  • This ensures that a maximum of throttle_threshold events can be sent to the ePO - On-prem in an epoch (the time between consecutive wakeups of the event processing thread).

Example:

If the throttle threshold is 1000 events per day, the endpoint sends a maximum average of 1000 events daily to ePO - On-prem. The event_send_quota value adjusts throughout the day to ensure this limit is not exceeded.

Key points

  • The throttle threshold defines the daily limit for events sent to ePO - On-prem.

  • This value is configurable and helps balance event flow over time.

  • The event_send_quota is capped by the throttle threshold to prevent excessive event transmission.

  • This mechanism optimizes system performance and prevents overwhelming ePO - On-prem with event data.