Welcome Serena Central users! CLICK HERE
The migration of the Serena Central community is currently underway. Be sure to read THIS MESSAGE to get your new login set up to access your account.
Outstanding Contributor.. rtoni1 Outstanding Contributor..
Outstanding Contributor..
109 views

ESM Command Center event search "scanned" value

This may be a silly question, as I am starting to play around more with the ESM command center and event searching from that platform, etc..

I notice if I search on a time frame only (no query defined) the "scanned" counter is much higher that the actual event count.  For example, a short search on all events over the past 2 minutes returns approx 24,000 events from over 870,000 events scanned.

When I mouse over the "Scanned (events/sec)" icon, it shows the scan rate as @ 820,000 events/sec.).

The smaller # (24,000) coincides with the actual event flow into this ESM from the Logger sources for that time frame.  So why are almost 1,000,000 events being scanned?  Not sure what this means....?  Is there a default time range the Logger will use to "scan" events, regardless of / well beyond the 2  minutes specified in the query?

Any sanity checks appreciated....

Labels (3)
0 Likes
2 Replies
pbrettle Acclaimed Contributor.
Acclaimed Contributor.

Re: ESM Command Center event search "scanned" value

There could be a number of different explanations for this, but the biggest and most relevant one is that this is a guesstimate number anyway. Its not 100% accurate and dependent on a number of different aspects.

Additionally, if you hit a bloom filter / super indexed field, it will work on chunks of data where the data isnt, so it will exclude a chunk of data based on the data not being there. It will then add this up as a part of the scan rate, even though it hasn't actually scanned that chunk - it knows how many events are in there, but it will estimate the total scan rate in my experience.

Not sure that this actually answers anything, but hopefully it makes some sense - now, if you get different results on the searches, now thats a concern and we need to figure out what is going on.

0 Likes
Outstanding Contributor.. rtoni1 Outstanding Contributor..
Outstanding Contributor..

Re: ESM Command Center event search "scanned" value

Thanks Paul for the quick reply.  I'm mostly just glad to know I'm not losing it.  I wonder if the short search interval might be a factor in exacerbating this effect.  A bit more playing around today and it seems that this gap shrinks / improves somewhat with longer searches.  For example if I run a  search for over hour or longer,  as the query hits the 1M event threshold the scan rate shows up as roughly double that #.  Whereas in the case of the 2 minute query the resulting event count is only a small fraction of the scan (24K vs 820K). 

Not losing sleep over this, but it is very interesting.  Thanks for the sanity check.

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.