How to monitor status and statistic of your sensors and agents with SSIM 4.6
|Article:TECH92794|||||Created: 2009-01-10|||||Updated: 2009-01-10|||||Article URL http://www.symantec.com/docs/TECH92794|
You want to monitor and view the status of your agent in the statistic table view.
There is a settings to enable to allow a high frequency of statistic in SSIM. The default value is set to 300s. Every 300s by default the Agent will send an event.
A typical event in stats is like this (see the indication of the percentage of the queue filled etc...)
You need to create a new configuration and get it assigned to your agent:
Go to System -> Product Configuration -> Logging Tab
Set "Agent Queue Statistic Report Interval" to a value between 5s to 10s (do not put it lower than 5s)
Also make sure the "Event queue flush time" is equal or lower than the stat interval.
Once this is done and distributed to the agents the statistic will start to show in table:
If this doesn't work make sure rule called : "System State monitor" is enabled.
To avoid to have your event archive filled up with statistic event you need to create a new archive dedicated to these events:
Go to System -> Appliance Configuration -> Expand your archive appliance -> Create a new archive.
In the number of days it is recommended to set to 1 but you might want to increase it if you want to report on these type of events for longuer period of time.
Make sure your archive is positioned near the top above your default archive.
Article URL http://www.symantec.com/docs/TECH92794