Blacklist Properties

This topic describes the various blacklist properties.

Blacklist analyzes requests from users for a specified duration called a session. The calculated value of the requests received in a session should not exceed a threshold value for any Blacklist factor. The duration of sessions can be defined for all users at a time or for each user independently.

Requests are not analyzed as soon as they are received. You can define the interval for the analysis. By default, requests received during each 15-second interval are taken up for analysis along with the requests received during all the preceding intervals during the session. The following table describes the properties that determine the duration of sessions and the interval for analysis.

Property	Default Value	Description
bus.blacklist.usersession.time	3600000 ms	This property determines the duration of a session for all users. The messages received within this duration are analyzed against the factors. The value must be specified in milliseconds.
<user DN>.session.time	3600000 ms	This property determines the duration of a session for a particular user. The messages received within this duration are analyzed against the factors. The value must be specified in milliseconds.
bus.blacklist.daemon	15000 ms	This property determines the interval of the calculations. The messages received within an interval are stored and taken up for calculation along with the requests received during all the preceding intervals within the session.
bus.blacklist.thresholdvalue	3 ms	The threshold value is determined from this property.