how to calculate EPS ?
How to calculate EPS ?
is there any default dashboard or report available for the same ??
There is an ESM dashboard which displays EPS. This Dashboard is located under /All Dashboards/ArcSight Administration/Connectors/System Health/Connector Connection and Cache Status.
This Dashboard shows EPS per connector, caching status and overall pre/post EPS. The Dashboard is in real time, so if you want historical event volume, then I highly recommend you create a Query/Trend/Report.
Thank you for your reply.
I want to calculate EPS for historical event volume ,so can you please let me know what should be the filter condition for the report.
It sounds like you want to filter by the agentType (not "arcsight_security_manager"), and the type("Base" or "Aggregated"), then grouping by second(managerReceiptTime). Basically you want to select all the events that come from monitored devices, and do not originate from the ESM/connectors. Assuming you don't forward events from another ESM, it should probably work.
Depending on the time frame you want to look at, this query might be resource intensive, and it could be beneficial to trend the query. If you trend it, depending on your needs, it might worth it to extend the group by clause with another fields in order to have a more granular result for analytical purposes, i.e. if you want to know the EPS per connector, deviceVendor, asset, etc. However, you need to be thoughtful on that, as the number of fields grows in the group by clause, the resource intensity goes up as well.
Hope this helps,
you can either look for events where deviceEventClassId=license:105-- that will give you the average number of incoming events per Sec(EPS) over that last 24 hours.
Those events feed an already built session list (All Session Lists/ArcSight Administration/ESM/Licensing/Licensing History) which also feeds a query/report that is also already built-- /All Report/ArcSight Administration/Licensing/Licensing report
In the custom parameter you need to change it from the default 'Assets" to EPS-- this will generate a chart over the last 7 days.
What I've done is create a query to query the session list for only LicenseType=EPS and dump it in a csv file--that way I can get event daily EPS licensing event
The session list will contains EPS events for everyday since your ESM was stood up.