Breadcrumbs

Log Files and Data Collected by the Diagnostic Tool

The following describes the data and log files collected by the LogRhythm Diagnostics Tool v3.1.0. Collection is organized by how and when data is retrieved.

Data Collected Upon Loading a Tab

SQL and InfluxDB Queries (Overview, Platform Health, Platform Sizing, AIE Performance)

The following data is collected automatically when the corresponding tab is opened. All queries are run against the Platform Manager's local SQL Server and InfluxDB instances using the LogRhythmDiagnostics read-only account.

Overview Tab

Queries LogRhythmEMDB for:

  • License ID and licensee name

  • LogRhythm, KB, EMDB, and SQL Server version information

  • Deployment topology: Platform Manager, Data Processors, DX Clusters, DX Nodes, AI Engines

Platform Health Tab

Queries LogRhythmEMDB, LogRhythm_LogMart, and InfluxDB for:

  • SQL Server database sizes, free space, and utilization

  • LogRhythm database versions and last update timestamps

  • LogRhythm SQL maintenance job history (last 30 days)

  • Database backup history

  • InfluxDB connectivity status (TCP/8076)

  • Per-component disk utilization and LogRhythm service status (collected from each Diagnostics Agent via the service mesh)

Platform Sizing Tab

Queries LogRhythm_LogMart and LogRhythmEMDB for:

  • Hourly processing, archiving, indexing, and event rates for each Data Processor over the last 30 days

  • Licensed, sustained, and peak rate specifications per component model

  • AI Engine processing rates and capacity

  • DX cluster indexing rates

  • Oversubscription analysis: hours over maximum sustained rate and minutes over maximum peak rate

  • N-1 redundancy headroom calculation for DP, AIE, and DX tiers

  • (Optional) Top 20 log sources by processed volume (opt-in; may be slow on large deployments)

AIE Performance Tab

Queries LogRhythmEMDB and InfluxDB for:

  • All enabled AIE rules: name, status, alarm-enabled flag, last modified date

  • Per-rule performance metrics: runtime cost, unshared memory cost, unshared memory size, recent events forwarded count/minutes, recent events feedback count/minutes

  • Per-block performance metrics

  • AIE rule change audit history

  • AIE workload configuration

  • AIE .dat spool file time-series data from InfluxDB (file counts and sizes over time)

Data Collected On Demand

Agent Log Collection (Export Logs Tab)

The following data is collected only when the user initiates an export from the Export Logs tab. The Diagnostics Tool fetches data from each selected lr-diagnostics-agent instance via the LogRhythm API Gateway and Service Registry.

Per-Node ZIP Contents

For each selected node, one ZIP archive (lrdiag-export-<nodename>.zip) is downloaded containing:

  • LogRhythm component log files for that node (the specific log files collected depend on the component type installed on the node: PM, DP, AIE, DX, or Web Console)

  • services.json: the name, display name, and status (running, stopped) of all LogRhythm services on the node

MPE Performance Data (MPE Performance Tab)

When the user opens or refreshes the MPE Performance tab, the Diagnostics Tool fetches the following from each Data Processor agent via the service mesh:

  • lps_detail_snapshot.log: the most recent LPS detail snapshot generated by the DP's Mediator service. This file contains per-rule LPS (logs per second), CPU cost, match/no-match attempt counts, and timeout information for all active MPE rules on that DP.

This file is read-only and not modified by the Diagnostics Tool.

Report Exports

Analysis reports are generated in-memory from the data already collected and are not written to disk until the user clicks a download button. The following export files can be generated:

Tab

Export File(s)

Platform Health

health-report-<YYYYMMDD-HHMMSS>.html

Platform Sizing

logmart-assessment-<YYYYMMDD-HHMMSS>.html, logmart-assessment-<YYYYMMDD-HHMMSS>.xlsx

AIE Performance

aie-performance-<YYYYMMDD-HHMMSS>.html

MPE Performance

mpe-performance-<hostname>-<YYYYMMDD-HHMMSS>.html (one per DP)

Export Logs

lrdiag-export-<nodename>.zip (one per selected node)

Data No Longer Collected

The following data types were collected by Diagnostics Tool v2.x but are not collected by v3.1.0:

  • Windows Performance Monitor (perfmon) counters

  • Elasticsearch / Data Indexer GET request responses (cluster health, node stats, index stats, shard stats)

  • EMDB bulk CSV exports (topology CSV, log source type counts CSV, AIE rule performance CSV, alarm rules CSV, GLPR CSV)

  • Capacity analysis text report (capacity_analysis.txt)

  • LRDiagnostics2 application logs and export logs bundled into the output ZIP