This section includes a brief description of each navigation tab and the information presented on the corresponding page.
Overview
Provides a summary of the LogRhythm SIEM deployment and its components. Data is read from the LogRhythm EMDB on the Platform Manager.
|
Section |
Description |
|---|---|
|
General Deployment Information |
Customer name, license ID, LogRhythm version, KB version, EMDB version, and SQL Server version. |
|
Deployment Topology |
Tables showing each LogRhythm component in the deployment: Platform Manager, Data Processors, DX Clusters, DX Nodes, and AI Engines. |
Platform Health
Provides health and status information for the LogRhythm deployment. Data is read from the LogRhythm EMDB, LogMart, and InfluxDB on the Platform Manager.
|
Section |
Description |
|---|---|
|
Database Stats |
SQL Server connectivity status, database sizes and free space, LogRhythm database versions, SQL maintenance job history, and database backup history. |
|
Disk Utilization |
Per-component disk stats collected from each Diagnostics Agent via the service mesh. |
|
Service Status |
Status (running, stopped) for all LogRhythm services on each component node, collected from each Diagnostics Agent. |
|
InfluxDB Connectivity |
Status of the InfluxDB connection on TCP/8076. |
|
Download Report |
Exports the Platform Health report as |
Platform Sizing
Performs a full LogMart analysis of the deployment's data processing pipeline and generates sizing recommendations. Analysis covers DP utilization, AIE engine power, DX cluster sizing, and N-1 redundancy headroom. Data is read from LogRhythm_LogMart and LogRhythmEMDB on the Platform Manager.
|
Section |
Description |
|---|---|
|
DP Utilization |
Processing and archiving rates for each Data Processor compared against licensed, sustained, and peak rate specifications. |
|
AIE Engine Power |
AI Engine processing rate analysis and capacity assessment. |
|
DX Cluster Sizing |
Data Indexer cluster indexing rate analysis. |
|
N-1 Redundancy |
Capacity headroom assessment showing whether the deployment can sustain its current load if one node is removed from each tier. |
|
Top 20 Log Sources |
Optional breakdown of the top 20 log sources by volume. This analysis may be slow on large deployments and is opt-in. |
|
Download Report |
Exports the full sizing report as |
AIE Performance
Provides detailed AI Engine performance analysis without requiring a full Platform Sizing run. Data is read from LogRhythmEMDB and InfluxDB.
|
Section |
Description |
|---|---|
|
Per-Rule and Per-Block Metrics |
Runtime cost, memory cost, event forwarding rates, and feedback rates for each enabled AIE rule and its blocks. |
|
Rule Change Audit |
History of recent AIE rule modifications. |
|
Workload Configuration |
AIE engine workload settings and current configuration. |
|
Rule Rankings – Slow Rules |
Rules with the highest runtime cost. |
|
Rule Rankings – Costly Rules |
Rules with the highest memory cost. |
|
Rule Rankings – Noisy Rules |
Rules generating the highest event forwarding volume. |
|
Stale Block Detection |
Identifies AIE blocks that have not processed events recently. |
|
.dat Spool Charts |
Time-series charts (via InfluxDB) showing AIE .dat spool file counts and sizes over time. |
|
Download Report |
Exports the AIE performance report as |
MPE Performance
Provides Multi-Platform Engine (MPE) rule performance analysis for each Data Processor. The Diagnostics Tool fetches lps_detail_snapshot.log from each DP via the LogRhythm service mesh and ranks rules by volume-weighted CPU cost.
|
Section |
Description |
|---|---|
|
Worst Overall |
MPE rules with the highest combined LPS × CPU cost across all match and no-match attempts. |
|
Worst No-Match |
MPE rules consuming the most CPU on logs they ultimately do not match (wasted processing). |
|
Worst Match |
MPE rules consuming the most CPU on logs they do match. |
|
High-Overhead Policies |
MPE policies whose aggregate rule processing overhead is disproportionately high. |
|
Rule Ordering Issues |
Surfaces cases where reordering rules within a policy could reduce overall CPU cost. |
|
Regex Timeouts |
MPE rules that have timed out during regex evaluation (from |
|
Download Report |
Exports the MPE performance report for each DP as |
Export Logs
Downloads raw log files and service status from each LogRhythm component node in the deployment. The Diagnostics Tool automatically discovers all registered lr-diagnostics-agent instances from the Consul/Service Registry—no manual node configuration is required.
|
Section |
Description |
|---|---|
|
Node Discovery |
All Diagnostics Agent instances registered in Service Registry are listed automatically. |
|
Per-Node Download |
Select one or more nodes and click Export to download a separate ZIP archive for each selected node, named |
|
ZIP Contents |
Each per-node ZIP contains the LogRhythm component log files for that node and a |
Hardware Health
Provides an overview of Hardware Health of all compatible appliances in the deployment
|
Section |
Description |
|---|---|
|
Node Discovery |
All Diagnostics Agent instances registered in Service Registry are listed automatically. |
|
Per-Node Details |
Displays the Overall Health (roll-up), Service Tag, System Model, iDRAC IP, and Firmware version of each appliance, if compatible. |
|
Get Disk Status |
Fetches the Physical Disk Details for the selected appliance. Shows the Disk Slot, Type, Size, State, Failure Prediction, Firmware version, and Write Endurance (if applicable). |
|
Generate TSR |
Triggers a TSR generation job to be run at the remote agent. TSR reports are used for detailed appliance troubleshooting and warranty replacements. TSR Generation jobs can take 10+ minutes. The UI monitors completion percentage as the job is running. |
|
Export TSR |
Fetches the full TSR report from the previous generation request after it is completed. This zip is fully intact without modification from the job itself. |