When the correlation rules generates an alert, it associates the trigger events to the alert for further investigation and reference. By default, the Alert Details page displays 10,000 events per alert. You can define the number of trigger events you want to view per alert.
To define the number of trigger events you want to view per alert:
Log in to the Sentinel server as the novell user.
Open the /etc/opt/novell/sentinel/config/configuration.properties file.
Set the desired value for the sentinel.alert.max.attachedevents property.
The maximum limit is 840,000.
Restart the Sentinel server.