Troubleshoot rule runtime errors

Runtime errors can occur during rule execution and prevent a rule from executing successfully. This document helps you troubleshoot some common runtime issues.

• You can prevent runtime errors by testing your rules before deployment. Click Run Testin the rules editor—if an error is detected, follow the error link for details.

• If an error occurs during rule execution, follow the error link on the Detectionspage for details.

Query syntax and logic errors

These errors occur when the query structure is invalid, too complex, or uses incompatible data types.

Cannot complete [arithmetic/mod] operation between unsigned and signed integer	Caused by attempting arithmetic operations ( + , - , * , / , MOD ) between different integer types.	Use cast.as_int() or cast.as_uint() to convert one field to match the other.

Resource limits and performance errors

These errors indicate that the query is too heavy for the system to process.

Your query resource usage is exceeding its allocation	The query was cancelled by the resource manager because it used too many resources.	Optimize the query by adding filters, such as by metadata.log_type .

Data access and system errors

These errors are often transient or related to the backend data storage.

Request was throttled, please try again later	The system is under heavy load.	Retry after some time.

Unknown runtime errors

You may encounter unknown runtime errors that lack a description. If this occurs, contact Google SecOps Support .

Need more help? Get answers from Community members and Google SecOps professionals.