Performance Counters—LR Mediator, Processing
- Service name. LogRhythm Mediator Server Service (scmedsvr)
- Runs on. Data Processor
- Performance Object. LogRhythm Message Processing Engine
- Platform Manager database. EMDB
| Performance Counter | Description |
|---|---|
| % Full Address Cache | The percentage full for the Address cache. Used for Log Deduplication. Cache Size / Cache Capacity. |
| % Full Archive Queue | The percentage full of the Archiving queue (logs awaiting archiving). Queue Size / Queue Capacity. |
| % Full Command Cache | The percentage full for the Command cache. Used for Log Deduplication. Cache Size / Cache Capacity |
| % Full Domain Cache | The percentage full for the Domain cache. Used for Log Deduplication. Cache Size / Cache Capacity. |
| % Full Group Cache | The percentage full for the Group cache. Used for Log Deduplication. Cache Size / Cache Capacity. |
| % Full Hostname Cache | The percentage full for the Hostname cache. Used for Log Deduplication. Cache Size / Cache Capacity. |
| % Full Interface Cache | The percentage full for the Interface cache. Used for Log Deduplication. Cache Size / Cache Capacity |
% Full Log Processing Queue | The percentage full of the Log Processing queue (logs not yet processed). Queue Size / Queue Capacity The mediator queue size (the maximum size of the archive queue and the unprocessed log queue) can be modified in the Data Processor Advanced Properties. |
| % Full MAC Address Cache | The percentage full for the MAC Address cache. Used for Log Deduplication. Cache Size / Cache Capacity |
| % Full Msg Aggregation Cache | The percentage full for the Msg Aggregation cache. Used for Log Deduplication. Cache Size / Cache Capacity. |
| % Full Object Cache | The percentage full for the Object cache. Used for Log Deduplication. Cache Size / Cache Capacity. |
| % Full Process Cache | The percentage full for the Process cache. Used for Log Deduplication. Cache Size / Cache Capacity. |
| % Full Severity Cache | The percentage full for the Severity cache. Used for Log Deduplication. Cache Size / Cache Capacity |
| % Full UC100 Cache | The percentage full for the UC100 cache. Used for Log Deduplication. Cache Size / Cache Capacity |
| % Full UC1000 Cache | The percentage full for the UC1000 cache. Used for Log Deduplication. Cache Size / Cache Capacity |
| % Full UC255 Cache | The percentage full for the UC255 cache. Used for Log Deduplication. Cache Size / Cache Capacity |
| % Full UC50 Cache | The percentage full for the UC50 cache. Used for Log Deduplication. Cache Size / Cache Capacity |
| % Full URL Cache | The percentage full for the URL cache. Used for Log Deduplication. Cache Size / Cache Capacity |
| % Full User Cache | The percentage full for the User cache. Used for Log Deduplication. Cache Size / Cache Capacity. |
| % Full Version Cache | The percentage full for the Version cache. Used for Log Deduplication. Cache Size / Cache Capacity |
| % Full VMID Cache | The percentage full for the VMID cache. Used for Log Deduplication. Cache Size / Cache Capacity. |
| EMIM % Full Disk Insert Queue | The percentage of the disk insert queue that is full of events waiting to be inserted into the Event database. |
| EMIM % Full Realtime Insert Queue | The percentage of the realtime insert queue that is full of events waiting to be inserted into the Event database. This counter indicates how current the insert manager is in processing the event inserts (100% means the events are being inserted in real time). |
| EMIM Current Spooled Files | The current number of spooled data files containing events waiting to be inserted into the Events database. |
| EMIM Current Spooled Logs | The current number of spooled events waiting to be inserted into the Events database. |
| EMIM Disk Insert Queue Size | The number of events in the disk insert queue waiting to be inserted into the Events database. |
| EMIM Insert Table Row Count | The number of events inserted into the Events database during the last insert operation. |
| EMIM Logs Dequeued From Disk Queue | The total number of events inserted into the Events database from the disk insert queue (versus the realtime insert queue) since startup. |
| EMIM Logs Dequeued From Realtime Queue | The total number of events inserted into the Events database from the realtime insert queue (versus the disk insert queue) since startup. |
| EMIM Logs Inserted In Batch | The number of events inserted into the Events database during the last insert operation. |
| EMIM Logs Processed By Insert Manager | The total number of events inserted by the insert manager into the Events database since startup. |
| EMIM Overall Insert Rate | The running insert rate for events into the Events database since startup. |
| EMIM Realtime Dequeue % | The percentage of events inserted into the Events database from the realtime insert queue (versus the disk insert queue) since startup. |
| EMIM Realtime Insert Queue Size | The number of events in the realtime insert queue waiting to be inserted into the Events database. |
| EMIM Total Logs Inserted | The total number of events inserted into the Events database since startup. |
| EMIM Total Spooled Files | The total number of spooled data files containing events waiting to be inserted into the Events database since startup. |
| EMIM Total Spooled Logs | The total number of spooled events waiting to be inserted into the Events database. |
| GLPRs Enabled | The number of enabled Global Log Processing Rules. |
| GLPRs Hit % | The percent of logs that matched a Global Log Processing Rule |
| GLPRs Processing Rate | The rate at which logs are being processed by all enabled Global Log Processing Rules. |
Intelligent Indexing Data Processor % Indexed | The percentage of logs processed against Data Processor Intelligent Indexing rules which matched a rule. |
Intelligent Indexing LogMart % Indexed | The percentage of logs processed against LogMart Intelligent Indexing rules that matched a rule. |
Intelligent Indexing Processing Rate | Intelligent Indexing Processing Rate |
| IPtoName DNS Avg. Resolution Time | The average time taken to perform IPToName resolution (in milliseconds.) |
| IPToName DNS Hit % | The percentage of IPToName DNS resolutions that resulted in a hit. |
Logs Archived to Disk / Sec | The rate logs are written from memory to disk during archiving. |
Logs Archived to Memory / Sec | The rate logs are queued into memory during archiving. |
Queue Count Archive | The total number of logs in memory in the Archive queue. Logs in this queue are awaiting being written to disk for archiving. |
| Queue Count Archive Sealing | The total number of active archives awaiting sealing. |
| Queue Count Processed Logs | The total number of processed logs awaiting insertion into the Data Processor and Events databases. |
| Queue Count Unprocessed Logs | The number of logs currently in the MPE Log Processing queue. |
Rate Events Inserted / Sec | The number of events inserted per second into the Events database. |
| Rate Logs Processed / Sec | The number of logs processed by the MPE per second. |
Rate Logs | The number of Log Data messages received from all connected Agents per second by the scmedsvr service. |