The Correlation Engine dashboard provides an overall picture of the health of the engine and the various rules deployed to it. The dashboard provides information on the activity of an engine and provides insights about which rules are behaving as expected and which rules might need additional tuning.
To view the Correlation Engine dashboard, select the desired Correlation Engine in the Correlation panel.
The dashboard displays a simple view of all the rules deployed to that engine and a list of rules available to deploy. You can also see some general information about the engine, such as its current state (running, stopped, or offline) and how long the engine has been in that state. There is also a summary that shows how many events the engine has processed, and an indication of current utilization of the engine (EPS utilization). In general, you can think of this number as something analogous to CPU utilization, but this metric indicates how much of the capacity of the engine is currently utilized. As the number of rules and the complexity of rules increases along with the current EPS (events per second) rate of the system, you can expect this number to grow larger.The tab provides a more granular view of engine activity. The various tabs represent various statistics, and you can select a given tab to sort the rules (ascending or descending) by these statistics to get a clear picture of how various rules are behaving and consuming resources.
The Correlation Engine dashboard also allows you to manage the engine and the rules in your system:
The following options are available to manage the Correlation Engine:
Stop: Stops an active Correlation Engine. When the engine stopped, it does not monitor the events against the deployed rules.
Undeploy all: Undeploys all the deployed rules from the engine.
Rename: Allows you to rename the engine.
This section lists the number of rules and the rules deployed in the engine.
The following options are displayed when you mouse over a rule:
View: Opens the Rule dashboard to provides overall information on the rule. For more information, see Section 4.10.1, Viewing the Rule Dashboard.
Disable: Allows you to disable the rule. When a rule is disabled, it does not process the events.
Undeploy: Undeploys the rule from the Correlation Engine.
This section helps you compare the rules based on parameters such as fire count, EPS capacity, and memory utilization. You can sort the rules as desired by using the up-arrow and down-arrow icons.
Fire count: The number of times the rule has fired since it was deployed or enabled. You can use this information to discover a rule that fires more than expected and that might need to be tuned, or to discover a rule that does not fire as often as you would expect. In either case, this tab guides you to the rules that are the most and least active.
Last fired: The last time the rule fired since it was deployed. This statistic is useful for determining the rules that are currently active and inactive in the system. A rule might have fired frequently, but it has not fired recently. Or, a rule might fire infrequently, but it fired recently. This tab gives you a real-time picture of what is active in the engine at any given time.
Fire rate: The number of times the rules have fired relative to the events processed by the engine. This statistic is similar to fire count in that it gives an indication of how active a rule is. However, instead of giving a raw count, the fire rate gives a percentage that is relative to the number of events a rule has processed. This normalizes the metric, and rules that were recently deployed can be compared with rules that were deployed at an earlier time.
EPS utilization: The events processing time the rule consumes relative to the capacity of the engine. This statistic provides an estimate of the amount of engine capacity a given correlation rule is currently consuming. Rules that are more complex, have time-consuming actions, or fire frequently consume more capacity. You can use this statistic to identify rules that need to be tuned or perhaps moved to another correlation engine for scalability reasons.
Memory utilization: The estimated memory utilization of the rule. In addition to EPS utilization, which provides a good picture of how much time a rule consumes relative to the total available processing time of the engine, the memory utilization gives a snapshot of roughly how much memory a rule is consuming. Rules consume memory when they have discriminators specified for fields with multiple values (through the list), and when rules hold events in memory for operations like the advanced “window” operation. Rules that consume a lot of memory are a potential liability to a healthy system and should be carefully reviewed to ensure they are properly written or possibly moved to another engine for scalability reasons.
This section lists the Correlation Engine details and so you can monitor the performance of the Correlation Engine.
Engine ID: The Correlation Engine ID.
Engine Name: The name of the Correlation Engine.
Host IP: The IP address of the host machine where the Correlation Engine is installed.
Hostname: The hostname of the machine where the Correlation Engine is installed
State: Whether the status of the Correlation Engine is running or stopped.
Events Processed: The number of events processed by the deployed rules since they were deployed.
Last changed state: The time the Correlation Engine status was last changed.
EPS utilization: The processing time the Correlation Engine consumes relative to the capacity of the engine.
This section lists the available rules in the system that are not deployed in the Correlation Engine. It also allows you to select rules and deploy them in the Correlation Engine.
The Correlation Engine is in the Start mode by default and keeps processing events for the rules deployed in the engine. You can determine when the Correlation Engine should process the events and start or stop the Correlation Engine accordingly.
Launch the Correlation interface.
For more information, see Section 4.2, Accessing the Correlation User Interface.
In the > section, select the Correlation Engine that you want to stop.
The Correlation Engine dashboard is displayed.
(Conditional) To stop the engine, click .
The engine is stopped and does not process any events.
(Conditional) To start the engine, click .
Launch the Correlation interface.
For more information, see Section 4.2, Accessing the Correlation User Interface.
In the > section, select the Correlation Engine that you want to rename.
The Correlation Engine dashboard is displayed.
Click , which is above the Rules Deployed section.
Modify the name of the engine, then click anywhere outside the field.