The MPE, a component of the Mediator Server service, keeps a record of how many times a rule has been compared to a log message and the total amount of time spent processing logs against each rule. This is accomplished by writing two logs: lps_detail.log which generates detailed statistics for a log processing policy for a given period of time; lps_policysortingstats.log which compiles a log per second rate of the policy over time. These reports give valuable input into system performance and the efficiency of rules being used in processing.
To send your report to LogRhythm automatically, configure the following parameters in the MPE component, and General group, of the Modify Data Processor Advanced Properties.
|Component||Group||Parameter Name||Value Type|
Sets the MPE logging level (log written to scmpe.log).
Options: Off, Error, Warning, Info, Verbose, Debug
How often to submit diagnostic information to LogRhythm (in hours). Enter 0 to disable sending
Local and Send
Rule performance statistics mode:
The MPE LogLevel must also be set.
How often to submit rule performance information to LogRhythm (in hours). The latest lps_detail.log and lps_stats.dat files are submitted each interval.