Knowledge Doc: [ArcSight Logger] Why can Logger EPS IN and EPS OUT Drop to 0 randomly ?

0 Likes

Summary
Why can the event EPS IN and EPS OUT statistics reported by Logger drop from a normal operating rate to goes to 0 randomly?

Products
ArcSight Logger

Environment
Logger 7.1.0 - Appliance (observed)
Can affect other versions.

Situation
The EPS IN and EPS OUT statistics of Logger can drop from their normal processing rate to 0 in a period of approximately 30 minutes.

This behaviour does not occur at a set (wall clock) time, but in general has been observed twice a day or so.

Cause
Full Storage Group(s).

For example, the issue has been observed when one storage group is almost at 100% for one storage group and the other at 85%:

STORAGEGRPONEPctUsed=99
STORAGEGRPTWOPctUsed=85

Resolution
Increase the size of storage group(s) or reduce retention policy.

As highlighted in the Logger Best Practices guide please note that to ensure better control of storage group retention and disk space utilization, do not allow storage group utilization to increase above 90%.

As storage groups near 99% utilization, Logger begins to run out of space to persist new events. The work (and time) required to free space to persist new events can cause them to wait (cache) periodically.

Additional Information
https://www.microfocus.com/documentation/arcsight/logger-7.2.1/pdfdoc/Logger_BestPractices/Logger_BestPractices.pdf

https://www.microfocus.com/documentation/arcsight/logger-7.2.1/pdfdoc/Logger_AdminGuide/Logger_AdminGuide.pdf

Support Article Link


URL Name
KM000008545

__________________________________

Elizabeth Knappen
CyberRes Community Manager

If you find this post useful, give it a ‘Like’ or use ‘Verify Answer’

Labels:

Knowledge Docs
Comment List
Anonymous
Related Discussions
Recommended