Cadet 2nd Class Cadet 2nd Class
Cadet 2nd Class
2754 views

how to calculate EPS ?

Hi Team,

How to calculate EPS ?

is there any default dashboard or report available for the same ??

Regards,

Naresh

Labels (1)
0 Likes
5 Replies
Vice Admiral Vice Admiral
Vice Admiral

There is an ESM dashboard which displays EPS. This Dashboard is located under /All Dashboards/ArcSight Administration/Connectors/System Health/Connector Connection and Cache Status.

This Dashboard shows EPS per connector, caching status and overall pre/post EPS. The Dashboard is in real time, so if you want historical event volume, then I highly recommend you create a Query/Trend/Report.

Brian Chong

0 Likes
Commander
Commander

You can also view the following dashboard:

/All Dashboards/ArcSight Administration/ESM/System Health/Event Throughput

0 Likes
Cadet 2nd Class Cadet 2nd Class
Cadet 2nd Class

Thank you for your reply.

I want to calculate EPS for historical event volume ,so can you please let me know what should be the filter condition for the report.

Regards,

Naresh

0 Likes
Commander
Commander

Hello,

It sounds like you want to filter by the agentType (not "arcsight_security_manager"), and the type("Base" or "Aggregated"), then grouping by second(managerReceiptTime). Basically you want to select all the events that come from monitored devices, and do not originate from the ESM/connectors. Assuming you don't forward events from another ESM, it should probably work.

Depending on the time frame you want to look at, this query might be resource intensive, and it could be beneficial to trend the query. If you trend it, depending on your needs, it might worth it to extend the group by clause with another fields in order to have a more granular result for analytical purposes, i.e. if you want to know the EPS per connector, deviceVendor, asset, etc. However, you need to be thoughtful on that, as the number of fields grows in the group by clause, the resource intensity goes up as well.

Hope this helps,

Adam

0 Likes
Cadet 3rd Class Cadet 3rd Class
Cadet 3rd Class

you can either look for  events where  deviceEventClassId=license:105-- that will give you the average number of incoming events per Sec(EPS) over that last 24 hours.

Those events feed an already built session list (All Session Lists/ArcSight Administration/ESM/Licensing/Licensing History)  which also feeds a query/report  that is also already built-- /All Report/ArcSight Administration/Licensing/Licensing report

In the custom parameter you need to change it from the default 'Assets" to EPS-- this will generate a chart over the last 7 days.

What I've done is create a query to query the session list for only LicenseType=EPS and dump it in a csv file--that way I can get event daily EPS licensing event

The session list will contains EPS events for everyday since your ESM was stood up.

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.