How to monitor status and statistic of your sensors and agents with SSIM 4.6

Article:TECH92794  |  Created: 2009-01-10  |  Updated: 2009-01-10  |  Article URL http://www.symantec.com/docs/TECH92794
Article Type
Technical Solution

Issue



You want to monitor and view the status of your agent in the statistic table view.


Solution



There is a settings to enable to allow a high frequency of statistic in SSIM. The default value is set to 300s. Every 300s by default the Agent will send an event.

A typical event in stats is like this (see the indication of the percentage of the queue filled etc...)



You need to create a new configuration and get it assigned to your agent:

Go to System -> Product Configuration -> Logging Tab



Set "Agent Queue Statistic Report Interval" to a value between 5s to 10s (do not put it lower than 5s)

Also make sure the "Event queue flush time" is equal or lower than the stat interval.

Once this is done and distributed to the agents the statistic will start to show in table:




If this doesn't work make sure rule called : "System State monitor" is enabled.


To avoid to have your event archive filled up with statistic event you need to create a new archive dedicated to these events:

Go to System -> Appliance Configuration -> Expand your archive appliance -> Create a new archive.




In the number of days it is recommended to set to 1 but you might want to increase it if you want to report on these type of events for longuer period of time.

Make sure your archive is positioned near the top above your default archive.








Legacy ID



2009031012152554


Article URL http://www.symantec.com/docs/TECH92794


Terms of use for this information are found in Legal Notices