Troubleshoot the Cisco AMP Beat

429 Too Many Requests Error

If you have exhausted your quota limit of API calls to Cisco AMP, you will see the following error:

API Call made to https://api.amp.cisco.com/v1/events?start_date=2018-09-28T03%3A17%3A08-07%3A00&limit=50&offset=1864
2020-05-04T23:13:42.030-0700 ERROR ciscoampclient/Ciscoamp.go:90 429 Too Many Requests%!(EXTRA <nil>)

If you see this error, go through the Cisco AMP Beat deployed configuration and check the Period parameter.

If Period is set below 4s, the beat will automatically reset it to 4s, for one instance of CiscoAMPBeat.
Cisco API supports 3000 calls per hour, so to avoid this error, Period (interval of api calls from beat) has been set to 4s by default, but when multiple instances of CiscoAMPBeat are running on the same account then a 4s Period value will not be enough. The limit will be exhausted before 1 hour and the beat will go into wait mode fo rthe remaining time frame. Users must modify this Period value based on the number of CiscoAMPBeat instances they want to run.